linux-kernel - Re: [PATCH v1] bcachefs: add check for btree id against max in try read node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <O4rJH-M2oslervXHx_G8BgaihhTfNDOLBvBL3_-k-xQ5v3RLnZ1m8WfhBENbliRTjeQV-22K7tqvKJzgLNeV2A72qKLNmFl5KBa_Y65unyo=@proton.me>
Date: Mon, 07 Oct 2024 02:53:13 +0000
From: Piotr Zalewski <pZ010001011111@...ton.me>
To: Piotr Zalewski <pZ010001011111@...ton.me>
Cc: kent.overstreet@...ux.dev, linux-bcachefs@...r.kernel.org, linux-kernel@...r.kernel.org, skhan@...uxfoundation.org, syzbot+cf7b2215b5d70600ec00@...kaller.appspotmail.com
Subject: Re: [PATCH v1] bcachefs: add check for btree id against max in try read node

> Add check for read node's btree_id against BTREE_ID_NR_MAX in
> try_read_btree_node to prevent triggering EBUG_ON condition in
> bch2_btree_id_root[1].

There seems to be some kind of (pro)regression regarding this issue. Now it
triggers a deadlock. I also found related bug detected by syzbot[2] for
which someone supplied the same patch recently and it triggered the same
deadlock. I will look into it (perhaps simple check isn't a proper fix 
here).

> [1] https://syzkaller.appspot.com/bug?extid=cf7b2215b5d70600ec00

[2] https://syzkaller.appspot.com/bug?extid=9f41e4b255897d99d4e9

> Reported-by: syzbot+cf7b2215b5d70600ec00@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=cf7b2215b5d70600ec00
> Fixes: 4409b8081d16 ("bcachefs: Repair pass for scanning for btree nodes")
> Signed-off-by: Piotr Zalewski pZ010001011111@...ton.me
> 
> ---
> fs/bcachefs/btree_node_scan.c | 3 +++
> 1 file changed, 3 insertions(+)
> 
> diff --git a/fs/bcachefs/btree_node_scan.c b/fs/bcachefs/btree_node_scan.c
> index b28c649c6838..a24b4004e8f0 100644
> --- a/fs/bcachefs/btree_node_scan.c
> +++ b/fs/bcachefs/btree_node_scan.c
> @@ -171,6 +171,9 @@ static void try_read_btree_node(struct find_btree_nodes *f, struct bch_dev *ca,
> if (BTREE_NODE_LEVEL(bn) >= BTREE_MAX_DEPTH)
> 
> return;
> 
> + if (BTREE_NODE_ID(bn) >= BTREE_ID_NR_MAX)
> 
> + return;
> +
> rcu_read_lock();
> struct found_btree_node n = {
> .btree_id = BTREE_NODE_ID(bn),
> --
> 2.46.2
>