CVE-2025-71301 Linux内核DRM shmem锁竞争漏洞

/* * Conceptual PoC for CVE-2025-71301 * This snippet demonstrates the missing lock context that leads to the race condition. * Note: Actual exploitation requires a local environment with DRM enabled. */ #include <linux/module.h> #include <linux/drm/drm_gem_shmem_helper.h> // Function simulating the vulnerable behavior static int simulate_vulnerability(struct drm_gem_shmem_object *shmem) { int ret; struct dma_buf_map map; // Vulnerability: The reservation lock is NOT held here. // In a correct implementation, dma_resv_lock(shmem->base.resv, NULL) should be called. // Calling the locked helper without the lock triggers the WARNING ret = drm_gem_shmem_vmap_locked(shmem, &map); if (ret) { pr_err("Failed to vmap: %d\n", ret); return ret; } // Perform operations on mapped memory... // Cleanup drm_gem_shmem_vunmap_locked(shmem, &map); // Vulnerability: Missing dma_resv_unlock(shmem->base.resv); return 0; }