CVE-2025-71111 Linux kernel w83791d驱动TOCTOU竞态条件漏洞

// PoC concept for CVE-2025-71111 TOCTOU race condition // This demonstrates the race condition in w83791d FAN_FROM_REG macro #include <stdio.h> #include <pthread.h> #include <stdatomic.h> // Original problematic macro (evaluates val multiple times) #define FAN_FROM_REG(val) ((val) && (val) != 255) ? (1350000U / (val)) : 0 // Simulated shared driver data static volatile unsigned long shared_fan_value = 100; static _Atomic int race_triggered = 0; void* writer_thread(void* arg) { // Simulates another thread modifying the shared value for (int i = 0; i < 1000; i++) { // Race: modify value to 0 between check and use shared_fan_value = 0; // This can cause divide-by-zero shared_fan_value = 100; } return NULL; } void* reader_thread(void* arg) { // Simulates using the problematic macro for (int i = 0; i < 1000; i++) { unsigned long val = shared_fan_value; // Original macro evaluates 'val' multiple times: // First check: (val) && (val) != 255 // Second use: (1350000U / (val)) // If val changes between checks, race condition occurs unsigned int result = FAN_FROM_REG(val); // Check if we hit the race condition if (shared_fan_value == 0 && val != 0) { race_triggered = 1; printf("Race condition detected!\n"); } } return NULL; } int main() { pthread_t t1, t2; pthread_create(&t1, NULL, writer_thread, NULL); pthread_create(&t2, NULL, reader_thread, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); printf("PoC execution completed.\n"); printf("Fix: Convert macro to static function with pass-by-value semantics.\n"); return 0; } // Fixed version: // static inline unsigned int fan_from_reg(unsigned long val) // { // return (val && val != 255) ? (1350000U / val) : 0; // }