linux-kernel - Re: WARNING in btrfs_quota

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAO4mrfdskw8gQUMgu5=+0yRLwE7tQDuCkaXB51scNku5PJRgLg@mail.gmail.com>
Date:   Tue, 15 Nov 2022 18:31:07 +0800
From:   Wei Chen <harperchen1110@...il.com>
To:     clm@...com, josef@...icpanda.com, dsterba@...e.com,
        linux-kernel@...r.kernel.org, linux-btrfs@...r.kernel.org,
        osandov@...com, sweettea-kernel@...miny.me,
        syzkaller-bugs@...glegroups.com
Subject: Re: WARNING in btrfs_quota_enable

Dear Linux developers,

I hope the following bug report is helpful.

Best,
Wei

On Sun, 6 Nov 2022 at 22:09, Wei Chen <harperchen1110@...il.com> wrote:
>
> Dear Linux Developer,
>
> Recently when using our tool to fuzz kernel, the following crash was
> triggered. The bug persists in Linux 6.0.
>
> HEAD commit: 4f5365f77018 Linux 5.15.76
> git tree: stable
> compiler: gcc 7.5.0
> console output:
> https://drive.google.com/file/d/1jbEJTcn-e-hkrpVGYqA0168AEYHGMFYR/view?usp=share_link
> kernel config: https://drive.google.com/file/d/1flhc33savDkmYN6PRU5C2vXDX0LAKMvM/view?usp=share_link
> C reproducer: https://drive.google.com/file/d/1VKO-bIWJcfkq1U5R_-YjwAz6uytPCUsw/view?usp=share_link
> Syz reproducer:
> https://drive.google.com/file/d/1C3DveQax7PoJ4rJ67tHddVYUbWSvTm7m/view?usp=share_link
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: Wei Chen <harperchen1110@...il.com>
>
> [  196.112397][ T8633] WARNING: CPU: 0 PID: 8633 at
> fs/btrfs/qgroup.c:1026 btrfs_quota_enable+0x1bfb/0x2320
> [  196.116525][ T8633] Modules linked in:
> [  196.118128][ T8633] CPU: 0 PID: 8633 Comm: a.out Not tainted 6.0.0 #38
> [  196.118608][ T8633] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> [  196.121470][ T8633] RIP: 0010:btrfs_quota_enable+0x1bfb/0x2320
> [  196.121899][ T8633] Code: e7 8a 48 8b 54 24 20 31 c0 e8 06 78 9a 06
> 4c 8b 7c 24 58 eb 17 e8 e5 5c f8 fd 48 c7 c7 e0 3d e7 8a 89 de 31 c0
> e8 65 d7 c1 fd <0f> 0b 48 8b 7c 24 18 48 c7 c6 80 3e e7 8a ba 02 04 00
> 00 4c 8b 74
> [  196.127785][ T8633] RSP: 0018:ffffc9000b00f620 EFLAGS: 00010246
> [  196.128190][ T8633] RAX: e82232a3d1ff4300 RBX: fffffffffffffff4
> RCX: ffff88801bf5a440
> [  196.128710][ T8633] RDX: 0000000000000000 RSI: 0000000080000000
> RDI: 0000000000000000
> [  196.132528][ T8633] RBP: ffffc9000b00f830 R08: ffffffff816b75fc
> R09: ffffed100c784f14
> [  196.133074][ T8633] R10: ffffed100c784f14 R11: 0000000000000000
> R12: ffff88802c5457d8
> [  196.135472][ T8633] R13: ffff88802ca17980 R14: 1ffff11005942f30
> R15: 1ffff92001601edc
> [  196.138552][ T8633] FS:  00007fda5da0b700(0000)
> GS:ffff888063c00000(0000) knlGS:0000000000000000
> [  196.139137][ T8633] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  196.141095][ T8633] CR2: 00007f84f55d0000 CR3: 000000002b93c000
> CR4: 0000000000750ef0
> [  196.141614][ T8633] DR0: 0000000000000000 DR1: 0000000000000000
> DR2: 0000000000000000
> [  196.143261][ T8633] DR3: 0000000000000000 DR6: 00000000fffe0ff0
> DR7: 0000000000000400
> [  196.143797][ T8633] PKRU: 55555554
> [  196.144035][ T8633] Call Trace:
> [  196.144262][ T8633]  <TASK>
> [  196.144751][ T8633]  ? read_lock_is_recursive+0x10/0x10
> [  196.145152][ T8633]  ? __del_qgroup_rb+0x600/0x600
> [  196.145487][ T8633]  ? __might_fault+0xb6/0x110
> [  196.149333][ T8633]  ? rcu_read_lock_sched_held+0x87/0x110
> [  196.149729][ T8633]  ? __lock_acquire+0x6080/0x6080
> [  196.150066][ T8633]  ? rcu_read_lock_any_held+0xb1/0x130
> [  196.151589][ T8633]  ? down_write+0x10d/0x170
> [  196.151890][ T8633]  ? down_read_killable+0x80/0x80
> [  196.152226][ T8633]  ? __might_fault+0xb2/0x110
> [  196.152544][ T8633]  ? _copy_from_user+0x106/0x160
> [  196.155487][ T8633]  btrfs_ioctl+0x6077/0x9db0
> [  196.155798][ T8633]  ? kfree+0xda/0x350
> [  196.156075][ T8633]  ? kasan_set_track+0x4f/0x60
> [  196.156399][ T8633]  ? kasan_set_track+0x3d/0x60
> [  196.160352][ T8633]  ? kasan_set_free_info+0x1f/0x40
> [  196.160740][ T8633]  ? ____kasan_slab_free+0xd8/0x120
> [  196.161087][ T8633]  ? slab_free_freelist_hook+0x12e/0x1a0
> [  196.162586][ T8633]  ? kfree+0xda/0x350
> [  196.162918][ T8633]  ? tomoyo_path_number_perm+0x5be/0x790
> [  196.163296][ T8633]  ? security_file_ioctl+0x55/0xb0
> [  196.164763][ T8633]  ? __se_sys_ioctl+0x48/0x170
> [  196.165093][ T8633]  ? do_syscall_64+0x3d/0x90
> [  196.165402][ T8633]  ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
> [  196.169938][ T8633]  ? btrfs_ioctl_get_supported_features+0x40/0x40
> [  196.170398][ T8633]  ? lockdep_hardirqs_on_prepare+0x428/0x790
> [  196.170806][ T8633]  ? rcu_read_lock_sched_held+0x87/0x110
> [  196.172301][ T8633]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
> [  196.172722][ T8633]  ? lockdep_hardirqs_on_prepare+0x428/0x790
> [  196.173125][ T8633]  ? do_vfs_ioctl+0xc35/0x29e0
> [  196.174572][ T8633]  ? __ia32_compat_sys_ioctl+0xb90/0xb90
> [  196.174965][ T8633]  ? __lock_acquire+0x6080/0x6080
> [  196.175301][ T8633]  ? slab_free_freelist_hook+0x12e/0x1a0
> [  196.178710][ T8633]  ? tomoyo_path_number_perm+0x5be/0x790
> [  196.179122][ T8633]  ? kfree+0xda/0x350
> [  196.179392][ T8633]  ? tomoyo_path_number_perm+0x627/0x790
> [  196.180886][ T8633]  ? tomoyo_check_path_acl+0x1c0/0x1c0
> [  196.181263][ T8633]  ? rcu_read_lock_sched_held+0x87/0x110
> [  196.181647][ T8633]  ? lockdep_hardirqs_on_prepare+0x428/0x790
> [  196.183052][ T8633]  ? print_irqtrace_events+0x220/0x220
> [  196.184574][ T8633]  ? vtime_user_exit+0x2b2/0x3e0
> [  196.184916][ T8633]  ? __ct_user_exit+0xd9/0x160
> [  196.185239][ T8633]  ? bpf_lsm_file_ioctl+0x5/0x10
> [  196.185570][ T8633]  ? security_file_ioctl+0x9d/0xb0
> [  196.190343][ T8633]  ? btrfs_ioctl_get_supported_features+0x40/0x40
> [  196.190782][ T8633]  __se_sys_ioctl+0xfb/0x170
> [  196.191099][ T8633]  do_syscall_64+0x3d/0x90
> [  196.192509][ T8633]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> [  196.192904][ T8633] RIP: 0033:0x7fda5cee4469
> [  196.193209][ T8633] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f
> 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b
> 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ff 49 2b 00 f7 d8
> 64 89 01 48
> [  196.195738][ T8633] RSP: 002b:00007ffd27fd1dc8 EFLAGS: 00000206
> ORIG_RAX: 0000000000000010
> [  196.196277][ T8633] RAX: ffffffffffffffda RBX: 0000000000000000
> RCX: 00007fda5cee4469
> [  196.198914][ T8633] RDX: 0000000020000180 RSI: 00000000c0109428
> RDI: 0000000000000006
> [  196.199425][ T8633] RBP: 00007ffd27fd1de0 R08: 0000000000000002
> R09: 00007ffd27fd1de0
> [  196.199985][ T8633] R10: 0000000000000001 R11: 0000000000000206
> R12: 0000559da6401170
> [  196.200504][ T8633] R13: 00007ffd27fd1f20 R14: 0000000000000000
> R15: 0000000000000000
> [  196.201068][ T8633]  </TASK>
> [  196.201291][ T8633] Kernel panic - not syncing: panic_on_warn set ...
> [  196.201722][ T8633] CPU: 0 PID: 8633 Comm: a.out Not tainted 6.0.0 #38
> [  196.202159][ T8633] Hardware name: QEMU Standard PC (i440FX + PIIX,
> 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> [  196.202813][ T8633] Call Trace:
> [  196.203044][ T8633]  <TASK>
> [  196.203240][ T8633]  dump_stack_lvl+0x1b1/0x28e
> [  196.203550][ T8633]  ? io_alloc_page_table+0xfe/0xfe
> [  196.203882][ T8633]  ? panic+0x81b/0x81b
> [  196.204153][ T8633]  ? btrfs_quota_enable+0x1bb0/0x2320
> [  196.204501][ T8633]  panic+0x2c2/0x81b
> [  196.204762][ T8633]  ? __warn+0x131/0x220
> [  196.205036][ T8633]  ? asan.module_ctor+0x4/0x4
> [  196.205350][ T8633]  ? btrfs_quota_enable+0x1bfb/0x2320
> [  196.205780][ T8633]  __warn+0x1fc/0x220
> [  196.206137][ T8633]  ? btrfs_quota_enable+0x1bfb/0x2320
> [  196.206610][ T8633]  report_bug+0x1b3/0x2d0
> [  196.207013][ T8633]  handle_bug+0x3d/0x70
> [  196.207384][ T8633]  exc_invalid_op+0x16/0x40
> [  196.207782][ T8633]  asm_exc_invalid_op+0x16/0x20
> [  196.208214][ T8633] RIP: 0010:btrfs_quota_enable+0x1bfb/0x2320
> [  196.208727][ T8633] Code: e7 8a 48 8b 54 24 20 31 c0 e8 06 78 9a 06
> 4c 8b 7c 24 58 eb 17 e8 e5 5c f8 fd 48 c7 c7 e0 3d e7 8a 89 de 31 c0
> e8 65 d7 c1 fd <0f> 0b 48 8b 7c 24 18 48 c7 c6 80 3e e7 8a ba 02 04 00
> 00 4c 8b 74
> [  196.210340][ T8633] RSP: 0018:ffffc9000b00f620 EFLAGS: 00010246
> [  196.210874][ T8633] RAX: e82232a3d1ff4300 RBX: fffffffffffffff4
> RCX: ffff88801bf5a440
> [  196.211550][ T8633] RDX: 0000000000000000 RSI: 0000000080000000
> RDI: 0000000000000000
> [  196.212225][ T8633] RBP: ffffc9000b00f830 R08: ffffffff816b75fc
> R09: ffffed100c784f14
> [  196.212906][ T8633] R10: ffffed100c784f14 R11: 0000000000000000
> R12: ffff88802c5457d8
> [  196.213582][ T8633] R13: ffff88802ca17980 R14: 1ffff11005942f30
> R15: 1ffff92001601edc
> [  196.214167][ T8633]  ? __wake_up_klogd+0xcc/0x100
> [  196.214491][ T8633]  ? read_lock_is_recursive+0x10/0x10
> [  196.214843][ T8633]  ? __del_qgroup_rb+0x600/0x600
> [  196.215181][ T8633]  ? __might_fault+0xb6/0x110
> [  196.215484][ T8633]  ? rcu_read_lock_sched_held+0x87/0x110
> [  196.215847][ T8633]  ? __lock_acquire+0x6080/0x6080
> [  196.216180][ T8633]  ? rcu_read_lock_any_held+0xb1/0x130
> [  196.216533][ T8633]  ? down_write+0x10d/0x170
> [  196.216831][ T8633]  ? down_read_killable+0x80/0x80
> [  196.217155][ T8633]  ? __might_fault+0xb2/0x110
> [  196.217462][ T8633]  ? _copy_from_user+0x106/0x160
> [  196.217783][ T8633]  btrfs_ioctl+0x6077/0x9db0
> [  196.218117][ T8633]  ? kfree+0xda/0x350
> [  196.218489][ T8633]  ? kasan_set_track+0x4f/0x60
> [  196.218827][ T8633]  ? kasan_set_track+0x3d/0x60
> [  196.219127][ T8633]  ? kasan_set_free_info+0x1f/0x40
> [  196.219446][ T8633]  ? ____kasan_slab_free+0xd8/0x120
> [  196.219830][ T8633]  ? slab_free_freelist_hook+0x12e/0x1a0
> [  196.220258][ T8633]  ? kfree+0xda/0x350
> [  196.220585][ T8633]  ? tomoyo_path_number_perm+0x5be/0x790
> [  196.220934][ T8633]  ? security_file_ioctl+0x55/0xb0
> [  196.221251][ T8633]  ? __se_sys_ioctl+0x48/0x170
> [  196.221548][ T8633]  ? do_syscall_64+0x3d/0x90
> [  196.221835][ T8633]  ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
> [  196.222224][ T8633]  ? btrfs_ioctl_get_supported_features+0x40/0x40
> [  196.222619][ T8633]  ? lockdep_hardirqs_on_prepare+0x428/0x790
> [  196.223004][ T8633]  ? rcu_read_lock_sched_held+0x87/0x110
> [  196.223353][ T8633]  ? __bpf_trace_rcu_stall_warning+0x10/0x10
> [  196.223724][ T8633]  ? lockdep_hardirqs_on_prepare+0x428/0x790
> [  196.224099][ T8633]  ? do_vfs_ioctl+0xc35/0x29e0
> [  196.224395][ T8633]  ? __ia32_compat_sys_ioctl+0xb90/0xb90
> [  196.224746][ T8633]  ? __lock_acquire+0x6080/0x6080
> [  196.225060][ T8633]  ? slab_free_freelist_hook+0x12e/0x1a0
> [  196.225406][ T8633]  ? tomoyo_path_number_perm+0x5be/0x790
> [  196.225752][ T8633]  ? kfree+0xda/0x350
> [  196.226002][ T8633]  ? tomoyo_path_number_perm+0x627/0x790
> [  196.226352][ T8633]  ? tomoyo_check_path_acl+0x1c0/0x1c0
> [  196.226690][ T8633]  ? rcu_read_lock_sched_held+0x87/0x110
> [  196.227067][ T8633]  ? lockdep_hardirqs_on_prepare+0x428/0x790
> [  196.227438][ T8633]  ? print_irqtrace_events+0x220/0x220
> [  196.227775][ T8633]  ? vtime_user_exit+0x2b2/0x3e0
> [  196.228084][ T8633]  ? __ct_user_exit+0xd9/0x160
> [  196.228385][ T8633]  ? bpf_lsm_file_ioctl+0x5/0x10
> [  196.228700][ T8633]  ? security_file_ioctl+0x9d/0xb0
> [  196.229011][ T8633]  ? btrfs_ioctl_get_supported_features+0x40/0x40
> [  196.229395][ T8633]  __se_sys_ioctl+0xfb/0x170
> [  196.229693][ T8633]  do_syscall_64+0x3d/0x90
> [  196.229970][ T8633]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> [  196.230326][ T8633] RIP: 0033:0x7fda5cee4469
> [  196.230609][ T8633] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f
> 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b
> 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ff 49 2b 00 f7 d8
> 64 89 01 48
> [  196.231750][ T8633] RSP: 002b:00007ffd27fd1dc8 EFLAGS: 00000206
> ORIG_RAX: 0000000000000010
> [  196.232248][ T8633] RAX: ffffffffffffffda RBX: 0000000000000000
> RCX: 00007fda5cee4469
> [  196.232721][ T8633] RDX: 0000000020000180 RSI: 00000000c0109428
> RDI: 0000000000000006
> [  196.233189][ T8633] RBP: 00007ffd27fd1de0 R08: 0000000000000002
> R09: 00007ffd27fd1de0
> [  196.233654][ T8633] R10: 0000000000000001 R11: 0000000000000206
> R12: 0000559da6401170
> [  196.234124][ T8633] R13: 00007ffd27fd1f20 R14: 0000000000000000
> R15: 0000000000000000
> [  196.234601][ T8633]  </TASK>
> [  196.235107][ T8633] Kernel Offset: disabled
> [  196.235468][ T8633] Rebooting in 86400 seconds..
>
> Best,
> Wei