netdev - Re: BUG: unable to handle kernel NULL pointer dereference in corrupted

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c85f1751-a6de-7993-d687-8277a48a118e@I-love.SAKURA.ne.jp>
Date:   Fri, 8 Jun 2018 23:08:08 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     Dmitry Vyukov <dvyukov@...gle.com>,
        syzbot <syzbot+f5066e369b2d5fff630f@...kaller.appspotmail.com>,
        ubraun@...ux.ibm.com, linux-s390@...r.kernel.org
Cc:     David Miller <davem@...emloft.net>,
        LKML <linux-kernel@...r.kernel.org>,
        netdev <netdev@...r.kernel.org>,
        syzkaller-bugs <syzkaller-bugs@...glegroups.com>
Subject: Re: BUG: unable to handle kernel NULL pointer dereference in
 corrupted

On 2018/06/08 22:39, Dmitry Vyukov wrote:
> On Fri, Jun 8, 2018 at 3:11 PM, syzbot
> <syzbot+f5066e369b2d5fff630f@...kaller.appspotmail.com> wrote:
>> Hello,
>>
>> syzbot found the following crash on:
>>
>> HEAD commit:    68abbe729567 Merge branch 'akpm' (patches from Andrew)
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=16f7cebf800000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=e5a4673d4582131c
>> dashboard link: https://syzkaller.appspot.com/bug?extid=f5066e369b2d5fff630f
>> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
>> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1191756f800000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=162236af800000
> 
> The reproducer suggests that this is in smc.
> +smc maintainers

Yes, an unprivileged user can trigger this oops.

----------
#include <sys/socket.h>
#include <sys/epoll.h>
#define PF_SMC 43

int main(int argc, char *argv[])
{
	struct epoll_event ev = { };
	int sfd = socket(PF_SMC, SOCK_STREAM, 0);
	int epfd = epoll_create(1);
	epoll_ctl(epfd, EPOLL_CTL_ADD, sfd, &ev);
	return 0;
}
----------