linux-kernel - WARNING in btrfs_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <3116e31e-8067-47ba-b0ca-a919e84f40ee.bugreport@valiantsec.com>
Date: Mon, 30 Sep 2024 15:38:01 +0800
From: "Ubisectech Sirius" <bugreport@...iantsec.com>
To: "linux-kernel" <linux-kernel@...r.kernel.org>
Cc: "clm" <clm@...com>,
  "josef" <josef@...icpanda.com>,
  "dsterba" <dsterba@...e.com>
Subject: WARNING in btrfs_remove_qgroup

Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.11.0-rc2-g6a0e38264012. Attached to the email were a PoC file of the issue.

Stack dump:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 10553 at fs/btrfs/qgroup.c:1854 btrfs_remove_qgroup+0xa4a/0xe80 fs/btrfs/qgroup.c:1854
Modules linked in:
CPU: 0 UID: 0 PID: 10553 Comm: btrfs-cleaner Not tainted 6.11.0-rc2-g6a0e38264012 #49
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:btrfs_remove_qgroup+0xa4a/0xe80 fs/btrfs/qgroup.c:1854
Code: 80 3c 02 00 0f 85 09 04 00 00 4c 8b b3 50 ff ff ff 31 ff 4c 89 f6 e8 f5 db fd fd 4d 85 f6 0f 84 8f 00 00 00 e8 07 e0 fd fd 90 <0f> 0b 90 48 c7 c6 c0 45 57 8b 48 c7 c7 c0 54 14 8e e8 e0 8d 26 07
RSP: 0018:ffffc90001f7fbe8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888020d104b8 RCX: ffffffff838b39fb
RDX: ffff888023d34a00 RSI: ffffffff838b3a09 RDI: 0000000000000007
RBP: 0000000000000100 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000002000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff888020d10408 R14: 0000000000002000 R15: ffff888020d10400
FS:  0000000000000000(0000) GS:ffff88802c600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8d38dddfe8 CR3: 000000001f5c6000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 btrfs_qgroup_cleanup_dropped_subvolume+0x168/0x1c0 fs/btrfs/qgroup.c:1904
 btrfs_drop_snapshot+0xc30/0x2210 fs/btrfs/extent-tree.c:6221
 btrfs_clean_one_deleted_snapshot+0x290/0x430 fs/btrfs/transaction.c:2649
 cleaner_kthread+0x2ea/0x4b0 fs/btrfs/disk-io.c:1520
 kthread+0x2c7/0x3b0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Thank you for taking the time to read this email and we look forward to working with you further.


Download attachment "poc.c" of type "application/octet-stream" (157456 bytes)