Su Yue 72eb9fc82a btrfs: tree-checker: check if chunk item end overflows ... [ Upstream commit 347fb0cfc9 ] While mounting a crafted image provided by user, kernel panics due to the invalid chunk item whose end is less than start. [66.387422] loop: module loaded [66.389773] loop0: detected capacity change from 262144 to 0 [66.427708] BTRFS: device fsid a62e00e8-e94e-4200-8217-12444de93c2e devid 1 transid 12 /dev/loop0 scanned by mount (613) [66.431061] BTRFS info (device loop0): disk space caching is enabled [66.431078] BTRFS info (device loop0): has skinny extents [66.437101] BTRFS error: insert state: end < start 29360127 37748736 [66.437136] ------------[ cut here ]------------ [66.437140] WARNING: CPU: 16 PID: 613 at fs/btrfs/extent_io.c:557 insert_state.cold+0x1a/0x46 [btrfs] [66.437369] CPU: 16 PID: 613 Comm: mount Tainted: G O 5.11.0-rc1-custom #45 [66.437374] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.14.0-1 04/01/2014 [66.437378] RIP: 0010:insert_state.cold+0x1a/0x46 [btrfs] [66.437420] RSP: 0018:ffff93e5414c3908 EFLAGS: 00010286 [66.437427] RAX: 0000000000000000 RBX: 0000000001bfffff RCX: 0000000000000000 [66.437431] RDX: 0000000000000000 RSI: ffffffffb90d4660 RDI: 00000000ffffffff [66.437434] RBP: ffff93e5414c3938 R08: 0000000000000001 R09: 0000000000000001 [66.437438] R10: ffff93e5414c3658 R11: 0000000000000000 R12: ffff8ec782d72aa0 [66.437441] R13: ffff8ec78bc71628 R14: 0000000000000000 R15: 0000000002400000 [66.437447] FS: 00007f01386a8580(0000) GS:ffff8ec809000000(0000) knlGS:0000000000000000 [66.437451] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [66.437455] CR2: 00007f01382fa000 CR3: 0000000109a34000 CR4: 0000000000750ee0 [66.437460] PKRU: 55555554 [66.437464] Call Trace: [66.437475] set_extent_bit+0x652/0x740 [btrfs] [66.437539] set_extent_bits_nowait+0x1d/0x20 [btrfs] [66.437576] add_extent_mapping+0x1e0/0x2f0 [btrfs] [66.437621] read_one_chunk+0x33c/0x420 [btrfs] [66.437674] btrfs_read_chunk_tree+0x6a4/0x870 [btrfs] [66.437708] ? kvm_sched_clock_read+0x18/0x40 [66.437739] open_ctree+0xb32/0x1734 [btrfs] [66.437781] ? bdi_register_va+0x1b/0x20 [66.437788] ? super_setup_bdi_name+0x79/0xd0 [66.437810] btrfs_mount_root.cold+0x12/0xeb [btrfs] [66.437854] ? __kmalloc_track_caller+0x217/0x3b0 [66.437873] legacy_get_tree+0x34/0x60 [66.437880] vfs_get_tree+0x2d/0xc0 [66.437888] vfs_kern_mount.part.0+0x78/0xc0 [66.437897] vfs_kern_mount+0x13/0x20 [66.437902] btrfs_mount+0x11f/0x3c0 [btrfs] [66.437940] ? kfree+0x5ff/0x670 [66.437944] ? __kmalloc_track_caller+0x217/0x3b0 [66.437962] legacy_get_tree+0x34/0x60 [66.437974] vfs_get_tree+0x2d/0xc0 [66.437983] path_mount+0x48c/0xd30 [66.437998] __x64_sys_mount+0x108/0x140 [66.438011] do_syscall_64+0x38/0x50 [66.438018] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [66.438023] RIP: 0033:0x7f0138827f6e [66.438033] RSP: 002b:00007ffecd79edf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [66.438040] RAX: ffffffffffffffda RBX: 00007f013894c264 RCX: 00007f0138827f6e [66.438044] RDX: 00005593a4a41360 RSI: 00005593a4a33690 RDI: 00005593a4a3a6c0 [66.438047] RBP: 00005593a4a33440 R08: 0000000000000000 R09: 0000000000000001 [66.438050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [66.438054] R13: 00005593a4a3a6c0 R14: 00005593a4a41360 R15: 00005593a4a33440 [66.438078] irq event stamp: 18169 [66.438082] hardirqs last enabled at (18175): [<ffffffffb81154bf>] console_unlock+0x4ff/0x5f0 [66.438088] hardirqs last disabled at (18180): [<ffffffffb8115427>] console_unlock+0x467/0x5f0 [66.438092] softirqs last enabled at (16910): [<ffffffffb8a00fe2>] asm_call_irq_on_stack+0x12/0x20 [66.438097] softirqs last disabled at (16905): [<ffffffffb8a00fe2>] asm_call_irq_on_stack+0x12/0x20 [66.438103] ---[ end trace e114b111db64298b ]--- [66.438107] BTRFS error: found node 12582912 29360127 on insert of 37748736 29360127 [66.438127] BTRFS critical: panic in extent_io_tree_panic:679: locking error: extent tree was modified by another thread while locked (errno=-17 Object already exists) [66.441069] ------------[ cut here ]------------ [66.441072] kernel BUG at fs/btrfs/extent_io.c:679! [66.442064] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [66.443018] CPU: 16 PID: 613 Comm: mount Tainted: G W O 5.11.0-rc1-custom #45 [66.444538] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.14.0-1 04/01/2014 [66.446223] RIP: 0010:extent_io_tree_panic.isra.0+0x23/0x25 [btrfs] [66.450878] RSP: 0018:ffff93e5414c3948 EFLAGS: 00010246 [66.451840] RAX: 0000000000000000 RBX: 0000000001bfffff RCX: 0000000000000000 [66.453141] RDX: 0000000000000000 RSI: ffffffffb90d4660 RDI: 00000000ffffffff [66.454445] RBP: ffff93e5414c3948 R08: 0000000000000001 R09: 0000000000000001 [66.455743] R10: ffff93e5414c3658 R11: 0000000000000000 R12: ffff8ec782d728c0 [66.457055] R13: ffff8ec78bc71628 R14: ffff8ec782d72aa0 R15: 0000000002400000 [66.458356] FS: 00007f01386a8580(0000) GS:ffff8ec809000000(0000) knlGS:0000000000000000 [66.459841] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [66.460895] CR2: 00007f01382fa000 CR3: 0000000109a34000 CR4: 0000000000750ee0 [66.462196] PKRU: 55555554 [66.462692] Call Trace: [66.463139] set_extent_bit.cold+0x30/0x98 [btrfs] [66.464049] set_extent_bits_nowait+0x1d/0x20 [btrfs] [66.490466] add_extent_mapping+0x1e0/0x2f0 [btrfs] [66.514097] read_one_chunk+0x33c/0x420 [btrfs] [66.534976] btrfs_read_chunk_tree+0x6a4/0x870 [btrfs] [66.555718] ? kvm_sched_clock_read+0x18/0x40 [66.575758] open_ctree+0xb32/0x1734 [btrfs] [66.595272] ? bdi_register_va+0x1b/0x20 [66.614638] ? super_setup_bdi_name+0x79/0xd0 [66.633809] btrfs_mount_root.cold+0x12/0xeb [btrfs] [66.652938] ? __kmalloc_track_caller+0x217/0x3b0 [66.671925] legacy_get_tree+0x34/0x60 [66.690300] vfs_get_tree+0x2d/0xc0 [66.708221] vfs_kern_mount.part.0+0x78/0xc0 [66.725808] vfs_kern_mount+0x13/0x20 [66.742730] btrfs_mount+0x11f/0x3c0 [btrfs] [66.759350] ? kfree+0x5ff/0x670 [66.775441] ? __kmalloc_track_caller+0x217/0x3b0 [66.791750] legacy_get_tree+0x34/0x60 [66.807494] vfs_get_tree+0x2d/0xc0 [66.823349] path_mount+0x48c/0xd30 [66.838753] __x64_sys_mount+0x108/0x140 [66.854412] do_syscall_64+0x38/0x50 [66.869673] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [66.885093] RIP: 0033:0x7f0138827f6e [66.945613] RSP: 002b:00007ffecd79edf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [66.977214] RAX: ffffffffffffffda RBX: 00007f013894c264 RCX: 00007f0138827f6e [66.994266] RDX: 00005593a4a41360 RSI: 00005593a4a33690 RDI: 00005593a4a3a6c0 [67.011544] RBP: 00005593a4a33440 R08: 0000000000000000 R09: 0000000000000001 [67.028836] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [67.045812] R13: 00005593a4a3a6c0 R14: 00005593a4a41360 R15: 00005593a4a33440 [67.216138] ---[ end trace e114b111db64298c ]--- [67.237089] RIP: 0010:extent_io_tree_panic.isra.0+0x23/0x25 [btrfs] [67.325317] RSP: 0018:ffff93e5414c3948 EFLAGS: 00010246 [67.347946] RAX: 0000000000000000 RBX: 0000000001bfffff RCX: 0000000000000000 [67.371343] RDX: 0000000000000000 RSI: ffffffffb90d4660 RDI: 00000000ffffffff [67.394757] RBP: ffff93e5414c3948 R08: 0000000000000001 R09: 0000000000000001 [67.418409] R10: ffff93e5414c3658 R11: 0000000000000000 R12: ffff8ec782d728c0 [67.441906] R13: ffff8ec78bc71628 R14: ffff8ec782d72aa0 R15: 0000000002400000 [67.465436] FS: 00007f01386a8580(0000) GS:ffff8ec809000000(0000) knlGS:0000000000000000 [67.511660] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [67.535047] CR2: 00007f01382fa000 CR3: 0000000109a34000 CR4: 0000000000750ee0 [67.558449] PKRU: 55555554 [67.581146] note: mount[613] exited with preempt_count 2 The image has a chunk item which has a logical start 37748736 and length 18446744073701163008 (-8M). The calculated end 29360127 overflows. EEXIST was caught by insert_state() because of the duplicate end and extent_io_tree_panic() was called. Add overflow check of chunk item end to tree checker so it can be detected early at mount time. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=208929 CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Anand Jain <anand.jain@oracle.com> Signed-off-by: Su Yue <l@damenly.su> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-01-19 18:26:13 +01:00
..
tests	btrfs: Correctly handle empty trees in find_first_clear_extent_bit	2020-02-11 04:35:34 -08:00
Kconfig	btrfs: Fix build error while LIBCRC32C is module	2019-07-17 17:03:30 +02:00
Makefile	btrfs: migrate the block group lookup code	2019-09-09 14:59:04 +02:00
acl.c	btrfs: cleanup btrfs_setxattr_trans and drop transaction parameter	2019-04-29 19:02:44 +02:00
async-thread.c	Btrfs: fix crash during unmount due to race with delayed inode workers	2020-04-17 10:50:15 +02:00
async-thread.h	Btrfs: fix crash during unmount due to race with delayed inode workers	2020-04-17 10:50:15 +02:00
backref.c	btrfs: fix double free on ulist after backref resolution failure	2020-07-29 10:18:30 +02:00
backref.h	btrfs: fiemap: preallocate ulists for btrfs_check_shared	2019-07-01 13:34:53 +02:00
block-group.c	btrfs: take overcommit into account in inc_block_group_ro	2020-10-17 10:11:21 +02:00
block-group.h	btrfs: move struct io_ctl to free-space-cache.h	2019-09-09 14:59:15 +02:00
block-rsv.c	btrfs: force chunk allocation if our global rsv is larger than metadata	2020-06-22 09:31:13 +02:00
block-rsv.h	btrfs: migrate the global_block_rsv helpers to block-rsv.c	2019-07-02 12:30:55 +02:00
btrfs_inode.h	btrfs: remove assumption about csum type form btrfs_print_data_csum_error()	2019-07-01 13:35:02 +02:00
check-integrity.c	btrfs: fix possible NULL-pointer dereference in integrity checks	2020-02-24 08:36:53 +01:00
check-integrity.h	btrfs: replace GPL boilerplate by SPDX -- headers	2018-04-12 16:29:46 +02:00
compression.c	btrfs: move cond_wake_up functions out of ctree	2019-09-09 14:59:15 +02:00
compression.h	btrfs: compression: replace set_level callbacks by a common helper	2019-09-09 14:59:11 +02:00
ctree.c	btrfs: cleanup cow block on error	2020-11-05 11:43:27 +01:00
ctree.h	btrfs: fix readahead hang and use-after-free after removing a device	2020-11-05 11:43:27 +01:00
delalloc-space.c	Btrfs: fix qgroup double free after failure to reserve metadata for delalloc	2019-10-17 20:13:44 +02:00
delalloc-space.h	btrfs: migrate the delalloc space stuff to it's own home	2019-07-04 17:26:17 +02:00
delayed-inode.c	btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode	2020-11-05 11:43:26 +01:00
delayed-inode.h	Btrfs: delayed-inode: use rb_first_cached for ins_root and del_root	2018-10-15 17:23:33 +02:00
delayed-ref.c	Btrfs: fix race between adding and putting tree mod seq elements and nodes	2020-02-11 04:35:34 -08:00
delayed-ref.h	btrfs: migrate the delayed refs rsv code	2019-07-04 17:26:17 +02:00
dev-replace.c	btrfs: dev-replace: fail mount if we don't have replace item with target device	2020-11-18 19:20:29 +01:00
dev-replace.h	btrfs: get fs_info from trans in btrfs_run_dev_replace	2019-04-29 19:02:43 +02:00
dir-item.c	btrfs: remove unused parameter fs_info from btrfs_extend_item	2019-04-29 19:02:50 +02:00
disk-io.c	btrfs: fix overflow when copying corrupt csums for a message	2020-10-01 13:18:24 +02:00
disk-io.h	btrfs: Make reada_tree_block_flagged private	2019-09-09 14:59:11 +02:00
export.c	btrfs: export helpers for subvolume name/id resolution	2020-08-26 10:40:49 +02:00
export.h	btrfs: export helpers for subvolume name/id resolution	2020-08-26 10:40:49 +02:00
extent-tree.c	btrfs: trim: fix underflow in trim length to prevent access beyond device boundary	2020-12-30 11:51:37 +01:00
extent_io.c	btrfs: prevent NULL pointer dereference in extent_io_tree_panic	2021-01-19 18:26:11 +01:00
extent_io.h	btrfs: trim: fix underflow in trim length to prevent access beyond device boundary	2020-12-30 11:51:37 +01:00
extent_map.c	Btrfs: fix race between using extent maps and merging them	2020-02-19 19:53:00 +01:00
extent_map.h	btrfs: Remove impossible condition from mergable_maps	2019-02-25 14:13:21 +01:00
file-item.c	btrfs: do not ignore error from btrfs_next_leaf() when inserting checksums	2020-06-22 09:30:55 +02:00
file.c	btrfs: allow btrfs_truncate_block() to fallback to nocow for data space reservation	2020-10-14 10:33:00 +02:00
free-space-cache.c	btrfs: fix space cache memory leak after transaction abort	2020-09-03 11:27:02 +02:00
free-space-cache.h	btrfs: move struct io_ctl to free-space-cache.h	2019-09-09 14:59:15 +02:00
free-space-tree.c	btrfs: move basic block_group definitions to their own header	2019-09-09 14:59:03 +02:00
free-space-tree.h	btrfs: move basic block_group definitions to their own header	2019-09-09 14:59:03 +02:00
inode-item.c	btrfs: Make btrfs_find_name_in_ext_backref return struct btrfs_inode_extref	2019-09-09 14:59:16 +02:00
inode-map.c	btrfs: qgroup: Always free PREALLOC META reserve in btrfs_delalloc_release_extents()	2019-10-15 18:50:07 +02:00
inode-map.h	btrfs: replace GPL boilerplate by SPDX -- headers	2018-04-12 16:29:46 +02:00
inode.c	btrfs: allow btrfs_truncate_block() to fallback to nocow for data space reservation	2020-10-14 10:33:00 +02:00
ioctl.c	btrfs: fix race when defragmenting leads to unnecessary IO	2021-01-06 14:48:36 +01:00
locking.c	btrfs: move cond_wake_up functions out of ctree	2019-09-09 14:59:15 +02:00
locking.h	btrfs: Remove unused locking functions	2019-09-09 14:58:59 +02:00
lzo.c	btrfs: compression: replace set_level callbacks by a common helper	2019-09-09 14:59:11 +02:00
misc.h	btrfs: move math functions to misc.h	2019-09-09 14:59:15 +02:00
ordered-data.c	Btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents	2020-02-28 17:22:24 +01:00
ordered-data.h	btrfs: don't assume ordered sums to be 4 bytes	2019-07-01 13:35:00 +02:00
orphan.c	btrfs: replace GPL boilerplate by SPDX -- sources	2018-04-12 16:29:51 +02:00
print-tree.c	btrfs: require only sector size alignment for parent eb bytenr	2020-09-17 13:47:51 +02:00
print-tree.h	btrfs: print-tree: debugging output enhancement	2018-04-20 19:18:16 +02:00
props.c	btrfs: rename the btrfs_calc_*_metadata_size helpers	2019-09-09 14:59:13 +02:00
props.h	btrfs: delete unused function btrfs_set_prop_trans	2019-04-29 19:02:54 +02:00
qgroup.c	btrfs: fix lockdep splat when reading qgroup config on mount	2020-12-02 08:49:45 +01:00
qgroup.h	btrfs: make btrfs_qgroup_check_reserved_leak take btrfs_inode	2020-09-03 11:26:47 +02:00
raid56.c	btrfs: get rid of unique workqueue helper functions	2020-01-09 10:20:06 +01:00
raid56.h	btrfs: constify map parameter for nr_parity_stripes and nr_data_stripes	2019-07-01 13:34:58 +02:00
rcu-string.h	btrfs: replace GPL boilerplate by SPDX -- headers	2018-04-12 16:29:46 +02:00
reada.c	btrfs: fix readahead hang and use-after-free after removing a device	2020-11-05 11:43:27 +01:00
ref-verify.c	btrfs: ref-verify: fix memory leak in btrfs_ref_tree_mod	2020-11-18 19:20:28 +01:00
ref-verify.h	btrfs: ref-verify: Use btrfs_ref to refactor btrfs_ref_tree_mod()	2019-04-29 19:02:49 +02:00
relocation.c	btrfs: fix min reserved size calculation in merge_reloc_root	2020-11-18 19:20:28 +01:00
root-tree.c	btrfs: do not delete mismatched root refs	2020-01-23 08:22:40 +01:00
scrub.c	btrfs: allocate scrub workqueues outside of locks	2020-09-09 19:12:31 +02:00
send.c	btrfs: send: fix wrong file path when there is an inode with a pending rmdir	2021-01-12 20:16:23 +01:00
send.h	btrfs: replace GPL boilerplate by SPDX -- headers	2018-04-12 16:29:46 +02:00
space-info.c	btrfs: take overcommit into account in inc_block_group_ro	2020-10-17 10:11:21 +02:00
space-info.h	btrfs: take overcommit into account in inc_block_group_ro	2020-10-17 10:11:21 +02:00
struct-funcs.c	btrfs: tie extent buffer and it's token together	2019-09-09 14:59:16 +02:00
super.c	btrfs: reset compression level for lzo on remount	2020-09-03 11:27:02 +02:00
sysfs.c	btrfs: sysfs: use NOFS for device creation	2020-08-21 13:05:22 +02:00
sysfs.h	btrfs: sysfs: move helper macros to sysfs.c	2019-09-09 14:59:08 +02:00
transaction.c	btrfs: add wrapper for transaction abort predicate	2020-08-26 10:40:49 +02:00
transaction.h	btrfs: add wrapper for transaction abort predicate	2020-08-26 10:40:49 +02:00
tree-checker.c	btrfs: tree-checker: check if chunk item end overflows	2021-01-19 18:26:13 +01:00
tree-checker.h	btrfs: get fs_info from eb in btrfs_check_chunk_valid	2019-04-29 19:02:39 +02:00
tree-defrag.c	btrfs: open code now trivial btrfs_set_lock_blocking	2019-02-25 14:13:27 +01:00
tree-log.c	btrfs: reschedule if necessary when logging directory items	2020-11-05 11:43:26 +01:00
tree-log.h	btrfs: get fs_info from trans in btrfs_set_log_full_commit	2019-04-29 19:02:41 +02:00
ulist.c	btrfs: replace GPL boilerplate by SPDX -- sources	2018-04-12 16:29:51 +02:00
ulist.h	btrfs: replace GPL boilerplate by SPDX -- headers	2018-04-12 16:29:46 +02:00
uuid-tree.c	btrfs: handle ENOENT in btrfs_uuid_tree_iterate	2019-12-31 16:42:05 +01:00
volumes.c	btrfs: trim: fix underflow in trim length to prevent access beyond device boundary	2020-12-30 11:51:37 +01:00
volumes.h	btrfs: fix readahead hang and use-after-free after removing a device	2020-11-05 11:43:27 +01:00
xattr.c	Btrfs: fix failure to persist compression property xattr deletion on fsync	2019-06-17 16:37:17 +02:00
xattr.h	btrfs: cleanup btrfs_setxattr_trans and drop transaction parameter	2019-04-29 19:02:44 +02:00
zlib.c	btrfs: compression: replace set_level callbacks by a common helper	2019-09-09 14:59:11 +02:00
zstd.c	btrfs: move cond_wake_up functions out of ctree	2019-09-09 14:59:15 +02:00