Date: Thu, 09 May 2024 10:53:50 +0800
From: "Ubisectech Sirius" <bugreport@...sectech.com>
To: "linux-trace-kernel" <linux-trace-kernel@...r.kernel.org>,
  "linux-kernel" <linux-kernel@...r.kernel.org>
Cc: "kent.overstreet" <kent.overstreet@...ux.dev>
Subject: WARNING: suspicious RCU usage in bch2_snapshot_tree_oldest_subvol

Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.7.  Attached to the email were a PoC file of the issue.

Stack dump:

snapshot points to missing/incorrect tree:
  u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent          0 children          0          0 subvol 1 tree 0, fixing
=============================
WARNING: suspicious RCU usage
6.7.0 #2 Not tainted
-----------------------------
fs/bcachefs/snapshot.h:41 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
5 locks held by syz-executor.2/71285:
 #0: ffff888073700268 (&c->state_lock){+.+.}-{3:3}, at: bch2_fs_start+0x97/0x5e0 fs/bcachefs/super.c:956
 #1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:116 [inline]
 #1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:215 [inline]
 #1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: __bch2_trans_get+0x594/0x950 fs/bcachefs/btree_iter.c:3020
 #2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline]
 #2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline]
 #2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline]
 #2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146
 #3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline]
 #3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline]
 #3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline]
 #3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146
 #4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline]
 #4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline]
 #4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline]
 #4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146

stack backtrace:
CPU: 1 PID: 71285 Comm: syz-executor.2 Not tainted 6.7.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106
 lockdep_rcu_suspicious+0x207/0x3b0 kernel/locking/lockdep.c:6712
 snapshot_t fs/bcachefs/snapshot.h:41 [inline]
 bch2_snapshot_tree_oldest_subvol+0x919/0xc40 fs/bcachefs/snapshot.c:445
 snapshot_tree_ptr_repair+0x642/0x1e40 fs/bcachefs/snapshot.c:685
 check_snapshot+0x1737/0x2640 fs/bcachefs/snapshot.c:808
 bch2_check_snapshots+0x2da/0x5c0 fs/bcachefs/snapshot.c:867
 bch2_run_recovery_pass fs/bcachefs/recovery.c:655 [inline]
 bch2_run_recovery_passes+0x2ba/0x510 fs/bcachefs/recovery.c:672
 bch2_fs_recovery+0x36fe/0x52d0 fs/bcachefs/recovery.c:918
 bch2_fs_start+0x365/0x5e0 fs/bcachefs/super.c:978
 bch2_fs_open+0x1ac9/0x3890 fs/bcachefs/super.c:1968
 bch2_mount+0x538/0x13c0 fs/bcachefs/fs.c:1863
 legacy_get_tree+0x109/0x220 fs/fs_context.c:662
 vfs_get_tree+0x93/0x380 fs/super.c:1771
 do_new_mount fs/namespace.c:3337 [inline]
 path_mount+0x679/0x1e40 fs/namespace.c:3664
 do_mount fs/namespace.c:3677 [inline]
 __do_sys_mount fs/namespace.c:3886 [inline]
 __se_sys_mount fs/namespace.c:3863 [inline]
 __x64_sys_mount+0x287/0x310 fs/namespace.c:3863
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x43/0x120 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7fe38c291b3e
Code: 48 c7 c0 ff ff ff ff eb aa e8 be 0d 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe38cf6ee38 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000000119fc RCX: 00007fe38c291b3e
RDX: 0000000020011a00 RSI: 0000000020000040 RDI: 00007fe38cf6ee90
RBP: 00007fe38cf6eed0 R08: 00007fe38cf6eed0 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000202 R12: 0000000020011a00
R13: 0000000020000040 R14: 00007fe38cf6ee90 R15: 0000000020000100
 </TASK>
 done
bcachefs (loop2): check_subvols... done
bcachefs (loop2): delete_dead_snapshots... done
bcachefs (loop2): resume_logged_ops... done
bcachefs (loop2): check_inodes... done
bcachefs (loop2): check_extents... done
bcachefs (loop2): check_indirect_extents... done
bcachefs (loop2): check_dirents... done
bcachefs (loop2): check_xattrs... done
bcachefs (loop2): check_root... done
bcachefs (loop2): check_directory_structure... done
bcachefs (loop2): check_nlinks... done
bcachefs (loop2): delete_dead_inodes... done
bcachefs (loop2): set_fs_needs_rebalance... done
bcachefs (loop2): Fixed errors, running fsck a second time to verify fs is clean
bcachefs (loop2): check_alloc_info... done
bcachefs (loop2): check_lrus... done
bcachefs (loop2): check_btree_backpointers... done
bcachefs (loop2): check_backpointers_to_extents... done
bcachefs (loop2): check_extents_to_backpointers... done
bcachefs (loop2): check_alloc_to_lru_refs... done
bcachefs (loop2): bucket_gens_init... done
bcachefs (loop2): check_snapshot_trees... done
bcachefs (loop2): check_snapshots... done
bcachefs (loop2): check_subvols... done
bcachefs (loop2): delete_dead_snapshots... done
bcachefs (loop2): resume_logged_ops... done
bcachefs (loop2): check_inodes... done
bcachefs (loop2): check_extents... done
bcachefs (loop2): check_indirect_extents... done
bcachefs (loop2): check_dirents... done
bcachefs (loop2): check_xattrs... done
bcachefs (loop2): check_root... done
bcachefs (loop2): check_directory_structure... done
bcachefs (loop2): check_nlinks... done
bcachefs (loop2): delete_dead_inodes... done
bcachefs (loop2): set_fs_needs_rebalance... done
bcachefs (loop2): flushing journal and stopping allocators, journal seq 11
bcachefs (loop2): flushing journal and stopping allocators complete, journal seq 11
bcachefs (loop2): marking filesystem clean

Thank you for taking the time to read this email and we look forward to working with you further.











Download attachment "poc.c" of type "application/octet-stream" (339716 bytes)

Powered by blists - more mailing lists