linux-kernel - Re: [PATCH v3 5/5] btrfs: rst: don't print tree dump in case lookup fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f1453e9f-c356-4053-9555-8e6d9c318368@wdc.com>
Date: Mon, 1 Jul 2024 15:03:58 +0000
From: Johannes Thumshirn <Johannes.Thumshirn@....com>
To: Josef Bacik <josef@...icpanda.com>, Johannes Thumshirn <jth@...nel.org>
CC: Chris Mason <clm@...com>, David Sterba <dsterba@...e.com>,
	"linux-btrfs@...r.kernel.org" <linux-btrfs@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3 5/5] btrfs: rst: don't print tree dump in case lookup
 fails

On 01.07.24 16:13, Josef Bacik wrote:
> On Mon, Jul 01, 2024 at 12:25:19PM +0200, Johannes Thumshirn wrote:
>> From: Johannes Thumshirn <johannes.thumshirn@....com>
>>
>> Don't print tree dump in case a raid-stripe-tree lookup fails.
>>
>> Dumping the stripe tree in case of a lookup failure was originally
>> intended to be a debug feature, but it turned out to be a problem, in case
>> of i.e. readahead.
>>
> 
> I have no objection to the change but I'm curious how readahead triggered this?
> Is there a problem here, or is it just when there is a problem readahead makes
> it particularly noisy?  Thanks,

There still is a bug in conjunction with RST and relocation's readahead.
But as I've stated in the cover letter, it is know, trivial to trigger, 
but I haven't fully root caused it yet.

All I can say is, that we're doing a use-after-free triggered by:

relocate_data_extent()
`-> relocate_file_extent_cluster()
  `-> relocate_one_folio()
   `-> page_cache_sync_readahead()
    `-> read_pages()

This most likely comes due to readahead requesting a l2p mapping that 
RST is unaware of, then splits the read bio (that I can see in my 
debugging) and the endio handler frees the original bio because of an 
error while the lower layer block driver still uses it.