linux-kernel - WARNING in btrfs_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <88961a5.13de8.197f869374b.Coremail.baishuoran@hrbeu.edu.cn>
Date: Fri, 11 Jul 2025 15:35:34 +0800 (GMT+08:00)
From: 白烁冉 <baishuoran@...eu.edu.cn>
To: "Chris Mason" <clm@...com>, "Josef Bacik" <josef@...icpanda.com>,
	"David Sterba" <dsterba@...e.com>
Cc: "Kun Hu" <huk23@...udan.edu.cn>, "Jiaji Qin" <jjtan24@...udan.edu.cn>,
	syzkaller@...glegroups.com, linux-btrfs@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: WARNING in btrfs_remove_chunk

Dear Maintainers,

When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (120th)was triggered.


HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/WARNING%20in%20btrfs_remove_chunk/120report.txt
Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/config.txt 
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/WARNING%20in%20btrfs_remove_chunk/120repro.c
Syzlang reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/WARNING%20in%20btrfs_remove_chunk/120repro.txt

Our reproducer uses mounts a constructed filesystem image.
 
 
The error occurred in line 3426 of volumes. c, in the error handling path of the btrfs_remove_chunk function. This may be because in the process of calling btrfs_remove_chunk to remove chunks during the balance operation, the first call to remove_chunk_item fails, returns - ENOSPC, and then enters the ENOSPC error recovery logic to try to allocate a new system chunk. And the system chunk space is exhausted, and the creation of a new system chunk fails.



If you fix this issue, please add the following tag to the commit:
Reported-by: Kun Hu <huk23@...udan.edu.cn>, Jiaji Qin <jjtan24@...udan.edu.cn>, Shuoran Bai <baishuoran@...eu.edu.cn>



------------[ cut here ]------------
BTRFS: Transaction aborted (error -28)
WARNING: CPU: 2 PID: 14048 at fs/btrfs/volumes.c:3426 btrfs_remove_chunk+0x1667/0x1a20
Modules linked in:
CPU: 2 UID: 0 PID: 14048 Comm: syz.1.10 Not tainted 6.14.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:btrfs_remove_chunk+0x1667/0x1a20
Code: 83 f9 19 77 0f b8 01 00 00 00 48 d3 e0 a9 01 00 04 02 75 49 e8 ca 71 e4 fd 90 48 c7 c7 20 5a ba 8b 44 89 e6 e8 ca 6b a4 fd 90 <0f> 0b 90 90 bb 01 00 00 00 e8 ab 71 e4 fd 48 8b 7c 24 08 41 89 d8
RSP: 0018:ffffc90002da7830 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc90003169000 RSI: ffff8880234e2480 RDI: 0000000000000002
RBP: ffff88804477cd00 R08: fffffbfff1c0b901 R09: ffffed1005725182
R10: ffffed1005725181 R11: ffff88802b928c0b R12: ffffffffffffffe4
R13: 00000000ffffffe4 R14: ffff88807830abec R15: ffff888078c48878
FS:  00007f09099aa700(0000) GS:ffff88802b900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d610ff8 CR3: 0000000053082000 CR4: 0000000000750ef0
PKRU: 80000000
Call Trace:
 <TASK>
 btrfs_relocate_chunk+0x2bb/0x440
 btrfs_balance+0x201a/0x3f80
 btrfs_ioctl_balance+0x43f/0x6f0
 btrfs_ioctl+0x2c57/0x6230
 __x64_sys_ioctl+0x19e/0x210
 do_syscall_64+0xcf/0x250
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0908bacadd
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f09099a9ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0908da5fa0 RCX: 00007f0908bacadd
RDX: 0000000020000480 RSI: 00000000c4009420 RDI: 0000000000000004
RBP: 00007f0908c2ab8f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0908da5fac R14: 00007f0908da6038 R15: 00007f09099a9d40
 </TASK>






thanks,
Kun Hu