On Thu, Aug 29, 2024 at 2:38 AM Kees Cook <kees@xxxxxxxxxx> wrote: > On Tue, Aug 27, 2024 at 09:09:49PM -0700, Juefei Pu wrote: > > Hello, > > We found the following null-pointer-dereference issue using syzkaller > > on Linux v6.10. > > In seccomp! Yikes. > > > Unfortunately, the syzkaller failed to generate a reproducer. > > That's a bummer. > > > But at least we have the report: > > > > Oops: general protection fault, probably for non-canonical address > > 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI > > KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] > > CPU: 0 PID: 4493 Comm: systemd-journal Not tainted 6.10.0 #13 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > > RIP: 0010:__bpf_prog_run include/linux/filter.h:691 [inline] So, the issue can't be that we went through the seccomp filter setup path properly and the bpf_prog was never actually installed, because in that case we would've crashed in seccomp_cache_prepare_bitmap(). I'm pretty confused how we could've possibly gotten into this situation... What kind of test setup are you using - is this QEMU in TCG mode or in KVM mode? Can you share your vmlinux binary, so we can see if there's a clue left in the register state of the crash?
