Linux Kernel lan966x驱动拒绝服务漏洞

/* * PoC Concept: Demonstrating the missing error check leading to Kernel Oops. * This is a simplified representation of the vulnerable logic. */ struct page_pool *page_pool_create(...); void xdp_rxq_info_reg_mem_model(...); void vulnerable_function() { // Step 1: Call page_pool_create which might fail and return an error pointer struct page_pool *pool = page_pool_create(...); // VULNERABILITY: Missing IS_ERR(pool) check here. // If page_pool_create failed, 'pool' is an error pointer (e.g., -12). // Step 2: Unconditionally pass the pointer to XDP memory model registration // This function dereferences 'pool', causing a crash if it is invalid. xdp_rxq_info_reg_mem_model(..., pool); }