linux-kernel - [Linux Kernel Bug] kernel BUG in btrfs_get_root_ref (assertion failed: !anon_dev) and general protection fault in btrfs_update_reloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALGdzuo6awWdau3X=8XK547x2vX_-VoFmH1aPsqosRTQ5WzJVA@mail.gmail.com>
Date: Fri, 19 Jan 2024 22:15:09 -0600
From: Chenyuan Yang <chenyuan0y@...il.com>
To: linux-btrfs@...r.kernel.org, clm@...com, josef@...icpanda.com, 
	dsterba@...e.com
Cc: linux-kernel@...r.kernel.org, syzkaller@...glegroups.com, 
	Zijie Zhao <zzjas98@...il.com>
Subject: [Linux Kernel Bug] kernel BUG in btrfs_get_root_ref (assertion
 failed: !anon_dev) and general protection fault in btrfs_update_reloc_root

Dear Linux Kernel Developers for BTRFS,

We encountered "kernel BUG in btrfs_get_root_ref" and "general
protection fault in btrfs_update_reloc_root" when testing BTRFS with
Syzkaller and our generated specifications.

For "kernel BUG in btrfs_get_root_ref", it is an internal assertion
failure `ASSERT(!anon_dev)` in `btrfs_get_root_ref`
(https://elixir.bootlin.com/linux/latest/source/fs/btrfs/disk-io.c#L1319),
which asserts the `anno_dev` should be NULL but it is preallocated
here. I've attached the reproducible C program and report.

For "general protection fault in btrfs_update_reloc_root", it attempts
to deference the null pointer in `refcount_inc_not_zero(&root->refs)`
(https://elixir.bootlin.com/linux/latest/source/fs/btrfs/disk-io.h#L101),
which is invoked by `btrfs_update_reloc_root`
(https://elixir.bootlin.com/linux/v6.7/source/fs/btrfs/relocation.c#L926).
Here is the call trace:
```
general protection fault, probably for non-canonical address
0xdffffc00000000cd: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000668-0x000000000000066f]
[ 1904.856783][T69219] Call Trace:
[ 1904.857057][T69219]  <TASK>
[1904.857312][T69219] ? show_regs (arch/x86/kernel/dumpstack.c:479)
[1904.857693][T69219] ? die_addr (arch/x86/kernel/dumpstack.c:421
arch/x86/kernel/dumpstack.c:460)
[1904.858074][T69219] ? exc_general_protection
(arch/x86/kernel/traps.c:700 arch/x86/kernel/traps.c:642)
[1904.858515][T69219] ? asm_exc_general_protection
(./arch/x86/include/asm/idtentry.h:564)
[1904.858941][T69219] ? btrfs_update_reloc_root
(./include/linux/refcount.h:162 ./include/linux/refcount.h:227
/include/linux/refcount.h:245 fs/btrfs/disk-io.h:101
fs/btrfs/relocation.c:926)
[1904.859402][T69219] ? btrfs_update_reloc_root (fs/btrfs/relocation.c:929)
```
Unfortunately, we failed to find the reproducible program for
"general protection fault in btrfs_update_reloc_root". I have attached
the report and log for it.

If you have any questions or require more information, please feel
free to contact us.

Best,
Chenyuan

Download attachment "btrfs_update_reloc_root.report" of type "application/octet-stream" (4176 bytes)

Download attachment "btrfs_update_reloc_root.log" of type "application/octet-stream" (1060159 bytes)

Download attachment "btrfs_get_root_ref-repro.report" of type "application/octet-stream" (3402 bytes)

Download attachment "btrfs_get_root_ref-repro.cprog" of type "application/octet-stream" (189424 bytes)

Download attachment "btrfs_get_root_ref-repro.prog" of type "application/octet-stream" (36621 bytes)

Download attachment "btrfs_get_root_ref-repro.log" of type "application/octet-stream" (130928 bytes)