CVE-2025-68358: Linux内核Btrfs位域竞态条件导致的系统死锁漏洞

// CVE-2025-68358 PoC - Btrfs bitfield race condition // This PoC demonstrates the race condition in btrfs_clear_space_info_full() // Compile: gcc -pthread -o btrfs_race_poc btrfs_race_poc.c #include <stdio.h> #include <stdlib.h> #include <pthread.h> #include <stdint.h> #include <unistd.h> // Simulated btrfs_space_info structure with bitfield typedef struct { void *fs_info; void *parent; int clamp; // Bitfield members - the vulnerable fields unsigned int full:1; // bit 0 unsigned int chunk_alloc:1; // bit 1 unsigned int flush:1; // bit 2 pthread_mutex_t lock; } btrfs_space_info_t; btrfs_space_info_t data_sinfo; volatile int stop = 0; // Thread 1: Simulates btrfs_clear_space_info_full() without lock void* thread_clear_full(void* arg) { printf("[T1] Thread 1 started - simulating btrfs_clear_space_info_full()\n"); while (!stop) { // Race condition: Reading and writing bitfield without lock // This simulates: data_sinfo->full = 0; unsigned int temp = data_sinfo.full | (data_sinfo.chunk_alloc << 1) | (data_sinfo.flush << 2); temp &= ~0x1; // Clear full bit (bit 0) data_sinfo.full = (temp & 0x1); data_sinfo.chunk_alloc = (temp >> 1) & 0x1; data_sinfo.flush = (temp >> 2) & 0x1; usleep(1); // Small delay to increase race window } return NULL; } // Thread 2: Simulates do_async_reclaim_data_space() with lock void* thread_reclaim(void* arg) { printf("[T2] Thread 2 started - simulating do_async_reclaim_data_space()\n"); while (!stop) { pthread_mutex_lock(&data_sinfo.lock); // Simulate: space_info->flush = 0; unsigned int temp = data_sinfo.full | (data_sinfo.chunk_alloc << 1) | (data_sinfo.flush << 2); temp &= ~0x4; // Clear flush bit (bit 2) data_sinfo.full = (temp & 0x1); data_sinfo.chunk_alloc = (temp >> 1) & 0x1; data_sinfo.flush = (temp >> 2) & 0x1; pthread_mutex_unlock(&data_sinfo.lock); usleep(1); } return NULL; } int main() { printf("CVE-2025-68358 PoC - Btrfs Bitfield Race Condition\n"); printf("=================================================\n\n"); // Initialize structure memset(&data_sinfo, 0, sizeof(data_sinfo)); data_sinfo.flush = 1; // Initial state: flush = 1 pthread_mutex_init(&data_sinfo.lock, NULL); pthread_t t1, t2; // Create threads to trigger race condition pthread_create(&t1, NULL, thread_clear_full, NULL); pthread_create(&t2, NULL, thread_reclaim, NULL); // Run for 5 seconds to observe race conditions printf("Running race condition test for 5 seconds...\n"); sleep(5); stop = 1; pthread_join(t1, NULL); pthread_join(t2, NULL); printf("\nFinal state - flush=%d, full=%d, chunk_alloc=%d\n", data_sinfo.flush, data_sinfo.full, data_sinfo.chunk_alloc); printf("\nNote: In real kernel, this race can cause:\n"); printf("1. flush flag incorrectly remains 1 when no work is queued\n"); printf("2. Allocation requests block forever on tickets\n"); printf("3. System deadlock condition\n"); pthread_mutex_destroy(&data_sinfo.lock); return 0; }