Re: BUG: unable to handle kernel NULL pointer dereference in corrupted

[Tetsuo Handa]

On 2018/06/08 22:39, Dmitry Vyukov wrote:
> On Fri, Jun 8, 2018 at 3:11 PM, syzbot
> <syzbot+f5066e369b2d5fff630f@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>> Hello,
>>
>> syzbot found the following crash on:
>>
>> HEAD commit:    68abbe729567 Merge branch 'akpm' (patches from Andrew)
>> git tree:       upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=16f7cebf800000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=e5a4673d4582131c
>> dashboard link: https://syzkaller.appspot.com/bug?extid=f5066e369b2d5fff630f
>> compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
>> syzkaller repro:https://syzkaller.appspot.com/x/repro.syz?x=1191756f800000
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=162236af800000
> 
> The reproducer suggests that this is in smc.
> +smc maintainers

Yes, an unprivileged user can trigger this oops.

----------
#include <sys/socket.h>
#include <sys/epoll.h>
#define PF_SMC 43

int main(int argc, char *argv[])
{
	struct epoll_event ev = { };
	int sfd = socket(PF_SMC, SOCK_STREAM, 0);
	int epfd = epoll_create(1);
	epoll_ctl(epfd, EPOLL_CTL_ADD, sfd, &ev);
	return 0;
}
----------