* [PATCH] btrfs: set tree_root->node = NULL on error
@ 2020-06-30 18:53 Josef Bacik
2020-07-01 6:23 ` Nikolay Borisov
2020-07-01 18:05 ` David Sterba
0 siblings, 2 replies; 3+ messages in thread
From: Josef Bacik @ 2020-06-30 18:53 UTC (permalink / raw)
To: linux-btrfs, kernel-team; +Cc: Eric Sandeen
Eric reported an issue where mounting -o recovery with a fuzzed fs
resulted in a kernel panic. This is because we tried to free the tree
node, except it was an error from the read. Fix this by properly
resetting the tree_root->node == NULL in this case. The panic was the
following
BTRFS warning (device loop0): failed to read tree root
BUG: kernel NULL pointer dereference, address: 000000000000001f
RIP: 0010:free_extent_buffer+0xe/0x90 [btrfs]
Call Trace:
free_root_extent_buffers.part.0+0x11/0x30 [btrfs]
free_root_pointers+0x1a/0xa2 [btrfs]
open_ctree+0x1776/0x18a5 [btrfs]
btrfs_mount_root.cold+0x13/0xfa [btrfs]
? selinux_fs_context_parse_param+0x37/0x80
legacy_get_tree+0x27/0x40
vfs_get_tree+0x25/0xb0
fc_mount+0xe/0x30
vfs_kern_mount.part.0+0x71/0x90
btrfs_mount+0x147/0x3e0 [btrfs]
? cred_has_capability+0x7c/0x120
? legacy_get_tree+0x27/0x40
legacy_get_tree+0x27/0x40
vfs_get_tree+0x25/0xb0
do_mount+0x735/0xa40
__x64_sys_mount+0x8e/0xd0
do_syscall_64+0x4d/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f5302f851be
Fixes: b8522a1e5f42 ("btrfs: Factor out tree roots initialization during mount")
Reported-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
fs/btrfs/disk-io.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 7c07578866f3..c27022f13150 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2592,10 +2592,12 @@ static int __cold init_tree_roots(struct btrfs_fs_info *fs_info)
!extent_buffer_uptodate(tree_root->node)) {
handle_error = true;
- if (IS_ERR(tree_root->node))
+ if (IS_ERR(tree_root->node)) {
ret = PTR_ERR(tree_root->node);
- else if (!extent_buffer_uptodate(tree_root->node))
+ tree_root->node = NULL;
+ } else if (!extent_buffer_uptodate(tree_root->node)) {
ret = -EUCLEAN;
+ }
btrfs_warn(fs_info, "failed to read tree root");
continue;
--
2.24.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] btrfs: set tree_root->node = NULL on error
2020-06-30 18:53 [PATCH] btrfs: set tree_root->node = NULL on error Josef Bacik
@ 2020-07-01 6:23 ` Nikolay Borisov
2020-07-01 18:05 ` David Sterba
1 sibling, 0 replies; 3+ messages in thread
From: Nikolay Borisov @ 2020-07-01 6:23 UTC (permalink / raw)
To: Josef Bacik, linux-btrfs, kernel-team; +Cc: Eric Sandeen
On 30.06.20 г. 21:53 ч., Josef Bacik wrote:
> Eric reported an issue where mounting -o recovery with a fuzzed fs
> resulted in a kernel panic. This is because we tried to free the tree
> node, except it was an error from the read. Fix this by properly
> resetting the tree_root->node == NULL in this case. The panic was the
> following
>
> BTRFS warning (device loop0): failed to read tree root
> BUG: kernel NULL pointer dereference, address: 000000000000001f
> RIP: 0010:free_extent_buffer+0xe/0x90 [btrfs]
> Call Trace:
> free_root_extent_buffers.part.0+0x11/0x30 [btrfs]
> free_root_pointers+0x1a/0xa2 [btrfs]
> open_ctree+0x1776/0x18a5 [btrfs]
> btrfs_mount_root.cold+0x13/0xfa [btrfs]
> ? selinux_fs_context_parse_param+0x37/0x80
> legacy_get_tree+0x27/0x40
> vfs_get_tree+0x25/0xb0
> fc_mount+0xe/0x30
> vfs_kern_mount.part.0+0x71/0x90
> btrfs_mount+0x147/0x3e0 [btrfs]
> ? cred_has_capability+0x7c/0x120
> ? legacy_get_tree+0x27/0x40
> legacy_get_tree+0x27/0x40
> vfs_get_tree+0x25/0xb0
> do_mount+0x735/0xa40
> __x64_sys_mount+0x8e/0xd0
> do_syscall_64+0x4d/0x90
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x7f5302f851be
>
> Fixes: b8522a1e5f42 ("btrfs: Factor out tree roots initialization during mount")
> Reported-by: Eric Sandeen <sandeen@redhat.com>
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
> ---
> fs/btrfs/disk-io.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
> index 7c07578866f3..c27022f13150 100644
> --- a/fs/btrfs/disk-io.c
> +++ b/fs/btrfs/disk-io.c
> @@ -2592,10 +2592,12 @@ static int __cold init_tree_roots(struct btrfs_fs_info *fs_info)
> !extent_buffer_uptodate(tree_root->node)) {
> handle_error = true;
>
> - if (IS_ERR(tree_root->node))
> + if (IS_ERR(tree_root->node)) {
> ret = PTR_ERR(tree_root->node);
> - else if (!extent_buffer_uptodate(tree_root->node))
> + tree_root->node = NULL;
> + } else if (!extent_buffer_uptodate(tree_root->node)) {
> ret = -EUCLEAN;
> + }
So this is problematic only if we fail on the last iteration of the loop
as this results in init_tree_roots returning err value with
tree_root->node = -ERR. Subsequently the caller does: fail_tree_roots
which calls free_root_pointers on the bogus value. IMO this piece of
information should go into the changelog in some form or another.
>
> btrfs_warn(fs_info, "failed to read tree root");
> continue;
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] btrfs: set tree_root->node = NULL on error
2020-06-30 18:53 [PATCH] btrfs: set tree_root->node = NULL on error Josef Bacik
2020-07-01 6:23 ` Nikolay Borisov
@ 2020-07-01 18:05 ` David Sterba
1 sibling, 0 replies; 3+ messages in thread
From: David Sterba @ 2020-07-01 18:05 UTC (permalink / raw)
To: Josef Bacik; +Cc: linux-btrfs, kernel-team, Eric Sandeen
On Tue, Jun 30, 2020 at 02:53:02PM -0400, Josef Bacik wrote:
> Eric reported an issue where mounting -o recovery with a fuzzed fs
> resulted in a kernel panic. This is because we tried to free the tree
> node, except it was an error from the read. Fix this by properly
> resetting the tree_root->node == NULL in this case. The panic was the
> following
>
> BTRFS warning (device loop0): failed to read tree root
> BUG: kernel NULL pointer dereference, address: 000000000000001f
> RIP: 0010:free_extent_buffer+0xe/0x90 [btrfs]
> Call Trace:
> free_root_extent_buffers.part.0+0x11/0x30 [btrfs]
> free_root_pointers+0x1a/0xa2 [btrfs]
> open_ctree+0x1776/0x18a5 [btrfs]
> btrfs_mount_root.cold+0x13/0xfa [btrfs]
> ? selinux_fs_context_parse_param+0x37/0x80
> legacy_get_tree+0x27/0x40
> vfs_get_tree+0x25/0xb0
> fc_mount+0xe/0x30
> vfs_kern_mount.part.0+0x71/0x90
> btrfs_mount+0x147/0x3e0 [btrfs]
> ? cred_has_capability+0x7c/0x120
> ? legacy_get_tree+0x27/0x40
> legacy_get_tree+0x27/0x40
> vfs_get_tree+0x25/0xb0
> do_mount+0x735/0xa40
> __x64_sys_mount+0x8e/0xd0
> do_syscall_64+0x4d/0x90
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> RIP: 0033:0x7f5302f851be
>
> Fixes: b8522a1e5f42 ("btrfs: Factor out tree roots initialization during mount")
> Reported-by: Eric Sandeen <sandeen@redhat.com>
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Added to misc-next with Niks explanation, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-07-01 18:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-30 18:53 [PATCH] btrfs: set tree_root->node = NULL on error Josef Bacik
2020-07-01 6:23 ` Nikolay Borisov
2020-07-01 18:05 ` David Sterba
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).