Re: BUG: unable to handle kernel NULL pointer dereference in corrupted

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2018/06/08 22:39, Dmitry Vyukov wrote:
> On Fri, Jun 8, 2018 at 3:11 PM, syzbot
> <syzbot+f5066e369b2d5fff630f@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>> Hello,
>>
>> syzbot found the following crash on:
>>
>> HEAD commit:    68abbe729567 Merge branch 'akpm' (patches from Andrew)
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=16f7cebf800000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=e5a4673d4582131c
>> dashboard link: https://syzkaller.appspot.com/bug?extid=f5066e369b2d5fff630f
>> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
>> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1191756f800000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=162236af800000
> 
> The reproducer suggests that this is in smc.
> +smc maintainers

Yes, an unprivileged user can trigger this oops.

----------
#include <sys/socket.h>
#include <sys/epoll.h>
#define PF_SMC 43

int main(int argc, char *argv[])
{
	struct epoll_event ev = { };
	int sfd = socket(PF_SMC, SOCK_STREAM, 0);
	int epfd = epoll_create(1);
	epoll_ctl(epfd, EPOLL_CTL_ADD, sfd, &ev);
	return 0;
}
----------
--
To unsubscribe from this list: send the line "unsubscribe linux-s390" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Kernel Development]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Info]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Linux Media]     [Device Mapper]

  Powered by Linux