94 lines
5.7 KiB
Plaintext
94 lines
5.7 KiB
Plaintext
Link: https://bugzilla.kernel.org/show_bug.cgi?id=200403
|
|
Wen Xu 2018-07-04 17:21:58 UTC
|
|
|
|
Created attachment 277167 [details]
|
|
The (compressed) crafted image which causes crash
|
|
|
|
- Reproduce
|
|
# mkdir mnt
|
|
# mount -t btrfs 0.img mnt
|
|
# gcc -o poc poc.c
|
|
# ./poc ./mnt
|
|
# umount mnt
|
|
|
|
- Kernel message
|
|
[ 230.611533] BTRFS: device fsid 3381d111-94a3-4ac7-8f39-611bbbdab7e6 devid 1 transid 8 /dev/loop0
|
|
[ 230.632922] BTRFS info (device loop0): disk space caching is enabled
|
|
[ 230.632935] BTRFS info (device loop0): has skinny extents
|
|
[ 230.647496] BTRFS info (device loop0): creating UUID tree
|
|
[ 237.692643] ------------[ cut here ]------------
|
|
[ 237.692654] kernel BUG at fs/btrfs/volumes.c:1625!
|
|
[ 237.693822] invalid opcode: 0000 [#1] SMP KASAN PTI
|
|
[ 237.694867] CPU: 1 PID: 1387 Comm: umount Not tainted 4.18.0-rc1+ #8
|
|
[ 237.696177] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
|
|
[ 237.698177] RIP: 0010:btrfs_remove_chunk+0x37a/0xd60
|
|
[ 237.699209] Code: e0 48 39 85 28 ff ff ff 77 20 0f b6 85 27 ff ff ff 4d 89 6f 80 4c 89 f7 4d 89 67 89 41 88 47 88 e8 0b 01 f7 ff e9 f5 fe ff ff <0f> 0b 0f 85 5c 08 00 00 4d 8d 66 40 4c 89 f7 e8 42 f9 b6 ff 4c 89
|
|
[ 237.703034] RSP: 0018:ffff8801f0b0fad8 EFLAGS: 00010206
|
|
[ 237.704122] RAX: 0000000008000000 RBX: ffff8801ef4d7c38 RCX: 0000000000000000
|
|
[ 237.705572] RDX: ffffed003e161f30 RSI: 0000000000000e70 RDI: ffff8801f2a6ae70
|
|
[ 237.707035] RBP: ffff8801f0b0fc38 R08: ffff8801f0b0f9e0 R09: ffff8801f0b0fa20
|
|
[ 237.708485] R10: 0000000000000003 R11: ffffed003e161f7c R12: 0000000007400000
|
|
[ 237.709929] R13: 0000000000000001 R14: ffff8801f2bf0a50 R15: ffff8801f0b0fc10
|
|
[ 237.711391] FS: 00007f691b770840(0000) GS:ffff8801f6f00000(0000) knlGS:0000000000000000
|
|
[ 237.713034] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
|
|
[ 237.714206] CR2: 0000000000cb0348 CR3: 00000001f26f8000 CR4: 00000000000006e0
|
|
[ 237.719741] Call Trace:
|
|
[ 237.720274] ? btrfs_grow_device+0x240/0x240
|
|
[ 237.721193] ? kasan_check_read+0x11/0x20
|
|
[ 237.722080] ? mutex_lock+0x99/0xf0
|
|
[ 237.722854] btrfs_delete_unused_bgs+0x4b6/0x5c0
|
|
[ 237.723836] close_ctree+0x40a/0x460
|
|
[ 237.724586] ? transaction_kthread+0x250/0x250
|
|
[ 237.725523] ? dispose_list+0xa0/0xa0
|
|
[ 237.726303] btrfs_put_super+0x25/0x30
|
|
[ 237.727110] generic_shutdown_super+0xb9/0x1c0
|
|
[ 237.728032] kill_anon_super+0x24/0x40
|
|
[ 237.728814] btrfs_kill_super+0x31/0x220
|
|
[ 237.729630] deactivate_locked_super+0x6f/0xa0
|
|
[ 237.730548] deactivate_super+0x5e/0x80
|
|
[ 237.731352] cleanup_mnt+0x61/0xa0
|
|
[ 237.732060] __cleanup_mnt+0x12/0x20
|
|
[ 237.732835] task_work_run+0xc8/0xf0
|
|
[ 237.733605] exit_to_usermode_loop+0x125/0x130
|
|
[ 237.734530] do_syscall_64+0x138/0x170
|
|
[ 237.735331] entry_SYSCALL_64_after_hwframe+0x44/0xa9
|
|
[ 237.736676] RIP: 0033:0x7f691b050487
|
|
[ 237.737457] Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 c9 2b 00 f7 d8 64 89 01 48
|
|
[ 237.741327] RSP: 002b:00007ffdf3a06d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
|
|
[ 237.742889] RAX: 0000000000000000 RBX: 0000000000ca7030 RCX: 00007f691b050487
|
|
[ 237.744351] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000cae1e0
|
|
[ 237.745814] RBP: 0000000000cae1e0 R08: 0000000000000000 R09: 0000000000000015
|
|
[ 237.747289] R10: 00000000000006b2 R11: 0000000000000246 R12: 00007f691b55983c
|
|
[ 237.748750] R13: 0000000000000000 R14: 0000000000ca7210 R15: 00007ffdf3a07020
|
|
[ 237.750224] Modules linked in: snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd mac_hid i2c_piix4 soundcore ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear 8139too qxl drm_kms_helper crct10dif_pclmul syscopyarea sysfillrect sysimgblt fb_sys_fops ttm crc32_pclmul aesni_intel drm aes_x86_64 crypto_simd cryptd glue_helper 8139cp mii pata_acpi floppy
|
|
[ 237.760666] ---[ end trace 2e85051acb5f6dc1 ]---
|
|
[ 237.761718] RIP: 0010:btrfs_remove_chunk+0x37a/0xd60
|
|
[ 237.762827] Code: e0 48 39 85 28 ff ff ff 77 20 0f b6 85 27 ff ff ff 4d 89 6f 80 4c 89 f7 4d 89 67 89 41 88 47 88 e8 0b 01 f7 ff e9 f5 fe ff ff <0f> 0b 0f 85 5c 08 00 00 4d 8d 66 40 4c 89 f7 e8 42 f9 b6 ff 4c 89
|
|
[ 237.766977] RSP: 0018:ffff8801f0b0fad8 EFLAGS: 00010206
|
|
[ 237.768157] RAX: 0000000008000000 RBX: ffff8801ef4d7c38 RCX: 0000000000000000
|
|
[ 237.769672] RDX: ffffed003e161f30 RSI: 0000000000000e70 RDI: ffff8801f2a6ae70
|
|
[ 237.771147] RBP: ffff8801f0b0fc38 R08: ffff8801f0b0f9e0 R09: ffff8801f0b0fa20
|
|
[ 237.772650] R10: 0000000000000003 R11: ffffed003e161f7c R12: 0000000007400000
|
|
[ 237.774119] R13: 0000000000000001 R14: ffff8801f2bf0a50 R15: ffff8801f0b0fc10
|
|
[ 237.775598] FS: 00007f691b770840(0000) GS:ffff8801f6f00000(0000) knlGS:0000000000000000
|
|
[ 237.777297] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
|
|
[ 237.778496] CR2: 0000000000cb0348 CR3: 00000001f26f8000 CR4: 00000000000006e0
|
|
|
|
|
|
===== Extra info for btrfs-progs ======
|
|
It has one corrupted root item, (41 ROOT_ITEM 0) referring tree block
|
|
29364224, which is also UUID tree root.
|
|
It would cause original mode to hit BUG_ON().
|
|
Checking filesystem on /home/adam/btrfs/crafted_images/runtime/0.img
|
|
UUID: 3381d111-94a3-4ac7-8f39-611bbbdab7e6
|
|
checking extents
|
|
check/main.c:3677: check_owner_ref: BUG_ON `rec->is_root` triggered, value 1
|
|
btrfs(+0x572c2)[0x562d65da72c2]
|
|
btrfs(+0x6098d)[0x562d65db098d]
|
|
btrfs(+0x60bb6)[0x562d65db0bb6]
|
|
btrfs(+0x6179b)[0x562d65db179b]
|
|
btrfs(cmd_check+0x1199)[0x562d65db5589]
|
|
btrfs(main+0x88)[0x562d65d62768]
|
|
/usr/lib/libc.so.6(__libc_start_main+0xeb)[0x7f4fcbb1b06b]
|
|
btrfs(_start+0x2a)[0x562d65d6288a]
|