Messages in this thread | | | Subject | Re: BUG: unable to handle kernel NULL pointer dereference in corrupted | From | Tetsuo Handa <> | Date | Fri, 8 Jun 2018 23:08:08 +0900 |
| |
On 2018/06/08 22:39, Dmitry Vyukov wrote: > On Fri, Jun 8, 2018 at 3:11 PM, syzbot > <syzbot+f5066e369b2d5fff630f@syzkaller.appspotmail.com> wrote: >> Hello, >> >> syzbot found the following crash on: >> >> HEAD commit: 68abbe729567 Merge branch 'akpm' (patches from Andrew) >> git tree: upstream >> console output: https://syzkaller.appspot.com/x/log.txt?x=16f7cebf800000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=e5a4673d4582131c >> dashboard link: https://syzkaller.appspot.com/bug?extid=f5066e369b2d5fff630f >> compiler: gcc (GCC) 8.0.1 20180413 (experimental) >> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1191756f800000 >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=162236af800000 > > The reproducer suggests that this is in smc. > +smc maintainers
Yes, an unprivileged user can trigger this oops.
---------- #include <sys/socket.h> #include <sys/epoll.h> #define PF_SMC 43
int main(int argc, char *argv[]) { struct epoll_event ev = { }; int sfd = socket(PF_SMC, SOCK_STREAM, 0); int epfd = epoll_create(1); epoll_ctl(epfd, EPOLL_CTL_ADD, sfd, &ev); return 0; } ----------
| |