linux-kernel - kernel BUG in write_dev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <70ae959e.21a4.1967f5040b6.Coremail.luckd0g@163.com>
Date: Tue, 29 Apr 2025 10:11:28 +0800 (CST)
From: "Jianzhou Zhao" <luckd0g@....com>
To: stable@...r.kernel.org
Cc: shaggy@...nel.org, jfs-discussion@...ts.sourceforge.net,
	linux-kernel@...r.kernel.org
Subject:  kernel BUG in write_dev_supers  in  linux6.15-rc1

Hello, I found a potential bug titled "  kernel BUG in write_dev_supers  " with modified syzkaller in the  Linux6.15-rc1.
If you fix this issue, please add the following tag to the commit:  Reported-by: Jianzhou Zhao <luckd0g@....com>,    xingwei lee <xrivendell7@...il.com>
The commit of the kernel is : 0af2f6be1b4281385b618cb86ad946eded089ac8
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=4c918722cb7e3d7
compiler: gcc version 11.4.0

Unfortunately, we failed to generate the reproduction program of this bug.

------------[ cut here ]-----------------------------------------
 TITLE:   kernel BUG in write_dev_supers 
------------[ cut here ]------------
==================================================================
assertion failed: folio_order(folio) == 0, in fs/btrfs/disk-io.c:3856
------------[ cut here ]------------
kernel BUG at fs/btrfs/disk-io.c:3856!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 9462 Comm: syz-executor Not tainted 6.15.0-rc1-dirty #9 PREEMPT(full) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:write_dev_supers+0x7f0/0x910 fs/btrfs/disk-io.c:3856
Code: e9 03 ff ff ff e8 70 a3 eb fd b9 10 0f 00 00 48 c7 c2 60 c0 d9 8b 48 c7 c6 60 c7 d9 8b 48 c7 c7 e0 c0 d9 8b e8 41 d4 ca fd 90 <0f> 0b 48 8b 7c 24 38 e8 04 f9 51 fe e9 3d f9 ff ff e8 3a f8 51 fe
RSP: 0018:ffffc900053ff7c0 EFLAGS: 00010286
RAX: 0000000000000045 RBX: ffff888029e60000 RCX: ffffffff819a5929
RDX: 0000000000000000 RSI: ffff88801eb9bc80 RDI: 0000000000000002
RBP: ffffea0001560a00 R08: fffffbfff1c4bb00 R09: fffff52000a7feb1
R10: fffff52000a7feb0 R11: ffffc900053ff587 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 0000000001000000
FS:  000055556e3c5500(0000) GS:ffff888097b41000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8af4976080 CR3: 0000000076248000 CR4: 0000000000752ef0
PKRU: 80000000
Call Trace:
 <TASK>
 write_all_supers+0x921/0x3680 fs/btrfs/disk-io.c:4153
 btrfs_commit_transaction+0x2dad/0x4620 fs/btrfs/transaction.c:2541
 btrfs_sync_fs+0x130/0x760 fs/btrfs/super.c:1040
 sync_filesystem fs/sync.c:66 [inline]
 sync_filesystem+0x1d3/0x2a0 fs/sync.c:30
 generic_shutdown_super+0x74/0x390 fs/super.c:621
 kill_anon_super+0x3a/0x60 fs/super.c:1237
 btrfs_kill_super+0x3c/0x50 fs/btrfs/super.c:2100
 deactivate_locked_super+0xb8/0x130 fs/super.c:473
 deactivate_super fs/super.c:506 [inline]
 deactivate_super+0xb1/0xd0 fs/super.c:502
 cleanup_mnt+0x378/0x510 fs/namespace.c:1435
 task_work_run+0x16f/0x280 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x29e/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xdc/0x260 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe31fbadfcb
Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 90 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8
RSP: 002b:00007fff6eed1d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00000000000000cf RCX: 00007fe31fbadfcb
RDX: 00007fe31fa4eb30 RSI: 0000000000000009 RDI: 00007fff6eed1e50
RBP: 00007fff6eed1e50 R08: 0000000000000000 R09: 00007fff6eed1c20
R10: 000055556e3d8673 R11: 0000000000000246 R12: 00007fe31fc44135
R13: 00007fff6eed2f20 R14: 000055556e3d8600 R15: 000000000003644b
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:write_dev_supers+0x7f0/0x910 fs/btrfs/disk-io.c:3856
Code: e9 03 ff ff ff e8 70 a3 eb fd b9 10 0f 00 00 48 c7 c2 60 c0 d9 8b 48 c7 c6 60 c7 d9 8b 48 c7 c7 e0 c0 d9 8b e8 41 d4 ca fd 90 <0f> 0b 48 8b 7c 24 38 e8 04 f9 51 fe e9 3d f9 ff ff e8 3a f8 51 fe
RSP: 0018:ffffc900053ff7c0 EFLAGS: 00010286
RAX: 0000000000000045 RBX: ffff888029e60000 RCX: ffffffff819a5929
RDX: 0000000000000000 RSI: ffff88801eb9bc80 RDI: 0000000000000002
RBP: ffffea0001560a00 R08: fffffbfff1c4bb00 R09: fffff52000a7feb1
R10: fffff52000a7feb0 R11: ffffc900053ff587 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 0000000001000000
FS:  000055556e3c5500(0000) GS:ffff8880eb341000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa5b213e730 CR3: 0000000076248000 CR4: 0000000000752ef0
PKRU: 80000000
==================================================================

I hope it helps.
Best regards
Jianzhou Zhao