CVE-2026-31756 Linux内核DWC2驱动死锁漏洞

/* * PoC Simulation for CVE-2026-31756 * This code demonstrates the logic error causing the deadlock. * It is a simplified representation of the vulnerable kernel code. */ #include <linux/spinlock.h> struct hsotg { spinlock_t lock; }; /* Simulates the call_gadget() macro behavior */ void call_gadget_mock(struct hsotg *hsotg) { // Expects lock to be held spin_unlock(&hsotg->lock); // ... gadget callback ... spin_lock(&hsotg->lock); } /* Simulates dwc2_gadget_exit_clock_gating */ void vulnerable_function(struct hsotg *hsotg) { call_gadget_mock(hsotg); } /* Simulates dwc2_hsotg_udc_stop (The Vulnerable Caller) */ void trigger_vulnerability(struct hsotg *hsotg) { unsigned long flags; // VULNERABILITY: Calls vulnerable_function WITHOUT holding hsotg->lock first. // This leads to spin_unlock on an unlocked lock (undefined behavior) // and leaves the lock held afterwards. vulnerable_function(hsotg); // Later in the function, tries to acquire the lock spin_lock_irqsave(&hsotg->lock, flags); // DEADLOCK occurs here because the lock is already held. spin_unlock_irqrestore(&hsotg->lock, flags); }