{"id":2165,"date":"2026-05-09T18:08:41","date_gmt":"2026-05-09T10:08:41","guid":{"rendered":"https:\/\/www.o6s.net\/?p=2165"},"modified":"2026-05-10T21:41:57","modified_gmt":"2026-05-10T13:41:57","slug":"%e7%b4%a7%e6%80%a5%e5%ae%89%e5%85%a8%e6%9b%b4%e6%96%b0-linux-kernel-dirty-frag-%e6%9c%ac%e5%9c%b0%e6%8f%90%e6%9d%83%e6%bc%8f%e6%b4%9e%e4%bf%ae%e5%a4%8d%ef%bc%8c%e8%af%b7%e5%b0%bd%e5%bf%ab%e5%8d%87","status":"publish","type":"post","link":"https:\/\/www.o6s.net\/index.php\/2026\/05\/09\/%e7%b4%a7%e6%80%a5%e5%ae%89%e5%85%a8%e6%9b%b4%e6%96%b0-linux-kernel-dirty-frag-%e6%9c%ac%e5%9c%b0%e6%8f%90%e6%9d%83%e6%bc%8f%e6%b4%9e%e4%bf%ae%e5%a4%8d%ef%bc%8c%e8%af%b7%e5%b0%bd%e5%bf%ab%e5%8d%87\/","title":{"rendered":"\u7d27\u6025\u5b89\u5168\u66f4\u65b0 | Linux Kernel Dirty Frag \u672c\u5730\u63d0\u6743\u6f0f\u6d1e\u4fee\u590d\uff0c\u8bf7\u5c3d\u5feb\u5347\u7ea7\uff01"},"content":{"rendered":"
\"\u56fe\u7247\"<\/section>\n

\ud83d\udd14<\/span><\/span>\u00a0\u4eb2\u7231\u7684 deepin \u7528\u6237\u4e0e\u793e\u533a\u4f19\u4f34\u4eec\uff1a<\/span><\/span><\/span><\/span><\/span><\/p>\n

\u8fd1\u671f\uff0cLinux Kernel \u88ab\u62ab\u9732\u5b58\u5728\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u4e1a\u754c\u79f0\u4e3a Dirty Frag \u6216 Copy Fail 2\u3002\u8be5\u6f0f\u6d1e\u5c5e\u4e8e Copy Fail \u6f0f\u6d1e\u540c\u7c7b\u53d8\u79cd\uff0c\u653b\u51fb\u8005\u5728\u5df2\u83b7\u5f97\u672c\u5730\u4f4e\u6743\u9650\u6267\u2f8f\u6761\u4ef6\u7684\u60c5\u51b5\u4e0b\uff0c\u53ef\u80fd\u5229\u2f64\u8be5\u6f0f\u6d1e\u7be1\u6539\u53ea\u8bfb\u2f42\u4ef6\u7684 page cache\uff0c\u8fdb\u2f00\u6b65\u63d0\u5347\u6743\u9650\u5e76\u83b7\u53d6 root \u6743\u9650\u3002<\/span><\/span><\/span><\/span><\/span><\/p>\n

\u2f6c\u524d\u516c\u5f00\u8d44\u6599\u663e\u2f70\uff0c\u8be5\u6f0f\u6d1e\u5229\u2f64\u4ee3\u7801\u5df2\u516c\u5f00\u4f20\u64ad\u3002<\/span>\u9274\u4e8e\u5176\u4e25\u91cd\u6027\u548c\u5e7f\u6cdb\u5f71\u54cd\uff0c<\/span><\/span>\u4e3a\u786e\u4fdd\u60a8\u7684\u7cfb\u7edf\u5b89\u5168\uff0c\u6211\u4eec\u5f3a\u70c8\u5efa\u8bae\u6240\u6709\u7528\u6237\u5c3d\u5feb\u5347\u7ea7\u3002<\/span><\/span><\/span><\/span><\/span><\/p>\n

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

01<\/strong><\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

\n
\n
\n

\u6f0f\u6d1e\u4fe1\u606f<\/span><\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

\u6f0f\u6d1e\u7f16\u53f7\uff1aCVE-2026-43284\u3001CVE-2026-43500<\/span><\/span><\/p>\n

\u6f0f\u6d1e\u63cf\u8ff0\uff1a<\/span><\/span><\/p>\n

\u8be5\u6f0f\u6d1e\u6d89\u53ca Linux \u5185\u6838\u2f79\u7edc\u534f\u8bae\u6808\u4e2d\u7684 xfrm-ESP \u548c RxRPC \u76f8\u5173\u5904\u7406\u8def\u5f84\u3002\u6f0f\u6d1e\u6e90\u4e8e\u96f6\u62f7\u2ec9\u53d1\u9001\u8def\u5f84\u4e2d\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7 splice() \u5c06\u53ea\u8bfb\u2f42\u4ef6\u7684 page cache \u2eda\u5f15\u2f0a sk_buff \u7684 frag \u533a\u57df\uff1b\u63a5\u6536\u4fa7\u5185\u6838\u4ee3\u7801\u5728\u7279\u5b9a\u6761\u4ef6\u4e0b\u672a\u5bf9\u5916\u90e8\u5171\u4eab frag \u505a\u6709\u6548\u9694\u79bb\u6216\u590d\u5236\uff0c\u968f\u540e\u6267\u2f8f\u539f\u5730\u52a0\u89e3\u5bc6\u64cd\u4f5c\uff0c\u5bfc\u81f4 page cache \u4e2d\u7684\u6570\u636e\u88ab\u5199\u2f0a\u4fee\u6539\u3002\u8be5\u95ee\u9898\u4e0e Dirty Pipe\u3001Copy Fail \u5c5e\u4e8e\u540c\u2f00\u7c7b page cache \u5199\u2f0a\u2edb\u9669\uff0c\u4f46\u5f71\u54cd\u2f0a\u2f1d\u4e0d\u518d\u662falgif_aead\uff0c\u2f7d\u662f sk_buff frag \u76f8\u5173\u8def\u5f84\u3002<\/span><\/span><\/p>\n

\u6f0f\u6d1e\u7b49\u7ea7\uff1a<\/span>\u9ad8\u5371<\/span><\/span><\/p>\n

\u5229\u7528\u6761\u4ef6\uff1a<\/span><\/span>
\n<\/span><\/p>\n

\u8be5\u6f0f\u6d1e\u94fe\u4e3b\u8981\u5305\u542b\u4e24\u4e2a\u89e6\u53d1\u2f45\u5411\uff1a<\/span><\/span><\/p>\n

1. xfrm-ESP Page-Cache Write\uff1a<\/span>ESP \u8f93\u2f0a\u8def\u5f84\u5728\u5904\u7406\u7279\u5b9a\u2fae\u7ebf\u6027 skb \u65f6\uff0c\u53ef\u80fd\u7ed5\u8fc7 skb_cow_data()\u590d\u5236\u9694\u79bb\u6d41\u7a0b\uff0c\u76f4\u63a5\u5728 skb frag \u4e0a\u6267\u2f8f\u539f\u5730 AEAD \u89e3\u5bc6\u64cd\u4f5c\u3002\u653b\u51fb\u8005\u53ef\u5728\u6ee1\u2f9c\u672c\u5730\u89e6\u53d1\u6761\u4ef6\u540e\uff0c\u5bf9 page cache \u9020\u6210\u53d7\u63a7\u5199\u2f0a\u3002<\/span><\/span><\/p>\n

2. RxRPC Page-Cache Write\uff1a<\/span>RxRPC \u7684 RXKAD \u5b89\u5168\u6821\u9a8c\u8def\u5f84\u4f1a\u5bf9 skb payload \u6267\u2f8f\u539f\u5730\u89e3\u5bc6\u64cd\u4f5c\u3002\u5728\u672a\u4fee\u590d\u5185\u6838\u4e2d\uff0c\u82e5 skb frag \u6307\u5411\u53ea\u8bfb\u2f42\u4ef6 page cache \u2eda\uff0c\u89e3\u5bc6\u5199\u2f0a\u4f1a\u843d\u5230 page cache\u4e0a\uff0c\u9020\u6210\u53ea\u8bfb\u2f42\u4ef6\u5185\u5b58\u6620\u50cf\u88ab\u4fee\u6539\u3002<\/span><\/span><\/p>\n

\u8be5\u95ee\u9898\u7684\u5b89\u5168\u5f71\u54cd\u4e0d\u4f9d\u8d56\u8fdc\u7a0b\u2f79\u7edc\u66b4\u9732\u3002\u653b\u51fb\u8005\u9700\u8981\u5148\u5177\u5907\u672c\u5730\u4f4e\u6743\u9650\u4ee3\u7801\u6267\u2f8f\u6761\u4ef6\uff0c\u4f8b\u5982\u666e\u901a\u2f64\u2f3eshell\u3001\u88ab\u653b\u9677\u670d\u52a1\u8fdb\u7a0b\u3001\u5bb9\u5668\u5185\u8fdb\u7a0b\u6216\u5176\u4ed6\u53d7\u9650\u6267\u2f8f\u73af\u5883\u3002\u2f00\u65e6\u89e6\u53d1\u6210\u529f\uff0c\u53ef\u80fd\u8fdb\u2f00\u6b65\u83b7\u5f97\u5bbf\u4e3b\u673a root\u6743\u9650\u3002<\/span><\/span><\/p>\n

\u5f71\u54cd\u8303\u56f4\uff1a<\/span><\/span>
\n<\/span><\/p>\n

\u6240\u6709\u672a\u66f4\u65b0 deepin 25 \u7684\u7528\u6237\u5747\u53d7\u5f71\u54cd\uff0c\u5efa\u8bae\u7acb\u5373\u66f4\u65b0\u5347\u7ea7\u3002<\/span><\/span><\/p>\n

\n
\n
\n
\n
\n
\n
\n
\n
\n
\n

02<\/strong><\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

\n
\n
\n

\u4fee\u590d\u8fdb\u5c55<\/span><\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

deepin 25\uff086.6 \u53ca 6.18 \u5185\u6838\uff09\uff1a\u5747\u5df2\u63a8\u9001\u4fee\u590d\u66f4\u65b0\uff0c\u8bf7\u5c3d\u5feb\u5347\u7ea7\uff01<\/span><\/span>
\n<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u5f80\u671f\u7cbe\u9009\u00a0<\/span><\/span><\/strong>\u00a0| \u00a0Selection in the past<\/span><\/span><\/section>\n
<\/span><\/a><\/section>\n
<\/span><\/a><\/section>\n

\n","protected":false},"excerpt":{"rendered":"

\ud83d\udd14\u00a0\u4eb2\u7231\u7684 deepin \u7528\u6237\u4e0e\u793e\u533a\u4f19\u4f34\u4eec\uff1a \u8fd1\u671f\uff0cLinux Kernel \u88ab\u62ab\u9732\u5b58\u5728\u672c\u5730\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u4e1a\u754c […]<\/p>\n","protected":false},"author":1,"featured_media":2164,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-2165","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-deepin"],"_links":{"self":[{"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/posts\/2165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/comments?post=2165"}],"version-history":[{"count":1,"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/posts\/2165\/revisions"}],"predecessor-version":[{"id":2166,"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/posts\/2165\/revisions\/2166"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/media\/2164"}],"wp:attachment":[{"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/media?parent=2165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/categories?post=2165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.o6s.net\/index.php\/wp-json\/wp\/v2\/tags?post=2165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}