CVE-2026-43227: Linux内核sh_tmu驱动锁上下文错误

/* * PoC Concept for CVE-2026-43227 * This code demonstrates the problematic locking scenario. * Triggering this requires a kernel configuration with PREEMPT_RT enabled * and hardware using the sh_tmu driver. */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/spinlock.h> // Simulate the raw spinlock used by clockevent framework static DEFINE_RAW_SPINLOCK(tick_broadcast_lock); // Simulate the normal spinlock used by pm_runtime static DEFINE_SPINLOCK(dev_power_lock); void simulated_sh_tmu_clock_event_set_oneshot(void) { unsigned long flags; // Step 1: Clockevent framework acquires raw spinlock raw_spin_lock_irqsave(&tick_broadcast_lock, flags); // Step 2: Driver tries to manage power (BUG occurs here) // In the real vulnerability, this calls __pm_runtime_resume // which tries to acquire dev->power.lock (a normal spinlock) printk(KERN_INFO "Attempting to acquire normal lock inside raw lock context...\n"); // This next line would trigger the 'Invalid wait context' warning // or deadlock in PREEMPT_RT // spin_lock(&dev_power_lock); // spin_unlock(&dev_power_lock); raw_spin_unlock_irqrestore(&tick_broadcast_lock, flags); } int init_module(void) { printk(KERN_INFO "CVE-2026-43227 PoC Module Loaded\n"); simulated_sh_tmu_clock_event_set_oneshot(); return 0; } void cleanup_module(void) { printk(KERN_INFO "CVE-2026-43227 PoC Module Unloaded\n"); } MODULE_LICENSE("GPL");