linux-kernel - Re: WARNING in btrfs_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANp29Y565yMhy2aGo4d1sX0XL8VrmSuNgFTsL47ARxsUhkb5zw@mail.gmail.com>
Date: Fri, 11 Jul 2025 09:44:52 +0200
From: Aleksandr Nogikh <nogikh@...gle.com>
To: 白烁冉 <baishuoran@...eu.edu.cn>
Cc: Kun Hu <huk23@...udan.edu.cn>, Jiaji Qin <jjtan24@...udan.edu.cn>, 
	syzkaller@...glegroups.com, linux-btrfs@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: WARNING in btrfs_remove_chunk

Hi Kun Hu,

Please note that the bug has already been reported to the mailing
lists by syzbot ~ 2 years ago:

https://syzkaller.appspot.com/bug?extid=e8582cc16881ec70a430
https://lore.kernel.org/all/00000000000089839605eeabb948@google.com/T/

On Fri, Jul 11, 2025 at 9:35 AM 白烁冉 <baishuoran@...eu.edu.cn> wrote:
>
> Dear Maintainers,
>
> When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash (120th)was triggered.
>
>
> HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
> git tree: upstream
> Output:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/WARNING%20in%20btrfs_remove_chunk/120report.txt
> Kernel config:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/config.txt
> C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/WARNING%20in%20btrfs_remove_chunk/120repro.c
> Syzlang reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/WARNING%20in%20btrfs_remove_chunk/120repro.txt
>
> Our reproducer uses mounts a constructed filesystem image.
>
>
> The error occurred in line 3426 of volumes. c, in the error handling path of the btrfs_remove_chunk function. This may be because in the process of calling btrfs_remove_chunk to remove chunks during the balance operation, the first call to remove_chunk_item fails, returns - ENOSPC, and then enters the ENOSPC error recovery logic to try to allocate a new system chunk. And the system chunk space is exhausted, and the creation of a new system chunk fails.
>
>
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: Kun Hu <huk23@...udan.edu.cn>, Jiaji Qin <jjtan24@...udan.edu.cn>, Shuoran Bai <baishuoran@...eu.edu.cn>
>
>
>
> ------------[ cut here ]------------
> BTRFS: Transaction aborted (error -28)
> WARNING: CPU: 2 PID: 14048 at fs/btrfs/volumes.c:3426 btrfs_remove_chunk+0x1667/0x1a20
> Modules linked in:
> CPU: 2 UID: 0 PID: 14048 Comm: syz.1.10 Not tainted 6.14.0 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> RIP: 0010:btrfs_remove_chunk+0x1667/0x1a20
> Code: 83 f9 19 77 0f b8 01 00 00 00 48 d3 e0 a9 01 00 04 02 75 49 e8 ca 71 e4 fd 90 48 c7 c7 20 5a ba 8b 44 89 e6 e8 ca 6b a4 fd 90 <0f> 0b 90 90 bb 01 00 00 00 e8 ab 71 e4 fd 48 8b 7c 24 08 41 89 d8
> RSP: 0018:ffffc90002da7830 EFLAGS: 00010282
> RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000
> RDX: ffffc90003169000 RSI: ffff8880234e2480 RDI: 0000000000000002
> RBP: ffff88804477cd00 R08: fffffbfff1c0b901 R09: ffffed1005725182
> R10: ffffed1005725181 R11: ffff88802b928c0b R12: ffffffffffffffe4
> R13: 00000000ffffffe4 R14: ffff88807830abec R15: ffff888078c48878
> FS:  00007f09099aa700(0000) GS:ffff88802b900000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000001b2d610ff8 CR3: 0000000053082000 CR4: 0000000000750ef0
> PKRU: 80000000
> Call Trace:
>  <TASK>
>  btrfs_relocate_chunk+0x2bb/0x440
>  btrfs_balance+0x201a/0x3f80
>  btrfs_ioctl_balance+0x43f/0x6f0
>  btrfs_ioctl+0x2c57/0x6230
>  __x64_sys_ioctl+0x19e/0x210
>  do_syscall_64+0xcf/0x250
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7f0908bacadd
> Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f09099a9ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007f0908da5fa0 RCX: 00007f0908bacadd
> RDX: 0000000020000480 RSI: 00000000c4009420 RDI: 0000000000000004
> RBP: 00007f0908c2ab8f R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007f0908da5fac R14: 00007f0908da6038 R15: 00007f09099a9d40
>  </TASK>
>
>
>
>
>
>
> thanks,
> Kun Hu
>

-- 
Aleksandr