blob: 3e4b273d9ec7f10161615850f7d6632316115bfe (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
|
URL: https://bugzilla.kernel.org/show_bug.cgi?id=199839
Wen Xu 2018-05-26 04:18:45 UTC
Created attachment 276197 [details]
The (compressed) crafted image which causes crash
- Overview
use-after-free in try_merge_free_space() when mounting a crafted btrfs image
- Reproduce (4.17 KASAN build)
# mkdir mnt
# mount -t btrfs 8.img mnt
- Kernel Message
[ 449.751861] BTRFS: device fsid 12b338de-a2e9-40fa-a4b0-90e53b7c5773 devid 1 transid 8 /dev/loop0
[ 449.757216] BTRFS info (device loop0): disk space caching is enabled
[ 449.757221] BTRFS info (device loop0): has skinny extents
[ 449.785096] BTRFS error (device loop0): bad tree block start 0 29396992
[ 449.788629] BTRFS info (device loop0): read error corrected: ino 0 off 29396992 (dev /dev/loop0 sector 73800)
[ 449.792965] BTRFS error (device loop0): bad fsid on block 29409280
[ 449.795193] BTRFS info (device loop0): read error corrected: ino 0 off 29409280 (dev /dev/loop0 sector 73824)
[ 449.795401] BTRFS info (device loop0): creating UUID tree
[ 449.883426] ==================================================================
[ 449.886228] BUG: KASAN: use-after-free in try_merge_free_space+0xc0/0x2e0
[ 449.888344] Read of size 8 at addr ffff8801ed10f030 by task mount/1291
[ 449.889947] CPU: 1 PID: 1291 Comm: mount Not tainted 4.17.0-rc5+ #6
[ 449.889951] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 449.889953] Call Trace:
[ 449.889976] dump_stack+0x7b/0xb5
[ 449.890274] print_address_description+0x70/0x290
[ 449.890286] kasan_report+0x291/0x390
[ 449.890296] ? try_merge_free_space+0xc0/0x2e0
[ 449.890303] __asan_load8+0x54/0x90
[ 449.890310] try_merge_free_space+0xc0/0x2e0
[ 449.890318] __btrfs_add_free_space+0x96/0x5e0
[ 449.890324] ? kasan_check_write+0x14/0x20
[ 449.890331] ? btrfs_get_block_group+0x1e/0x30
[ 449.890337] ? block_group_cache_tree_search+0xef/0x150
[ 449.890343] unpin_extent_range+0x376/0x670
[ 449.890350] ? __exclude_logged_extent+0x160/0x160
[ 449.890358] btrfs_finish_extent_commit+0x15b/0x490
[ 449.890371] ? __find_get_block+0x106/0x400
[ 449.890378] ? btrfs_prepare_extent_commit+0x1a0/0x1a0
[ 449.890384] ? write_all_supers+0x714/0x1420
[ 449.890394] btrfs_commit_transaction+0xaf4/0xfa0
[ 449.890402] ? btrfs_apply_pending_changes+0xa0/0xa0
[ 449.890407] ? start_transaction+0x153/0x640
[ 449.890414] btrfs_create_uuid_tree+0x6a/0x170
[ 449.890419] open_ctree+0x3b26/0x3ce9
[ 449.890429] ? close_ctree+0x4a0/0x4a0
[ 449.890441] ? bdi_register_va+0x44/0x50
[ 449.890451] ? super_setup_bdi_name+0x11b/0x1a0
[ 449.890457] ? kill_block_super+0x80/0x80
[ 449.890468] ? snprintf+0x96/0xd0
[ 449.890479] btrfs_mount_root+0xae6/0xc60
[ 449.890485] ? btrfs_mount_root+0xae6/0xc60
[ 449.890491] ? pcpu_block_update_hint_alloc+0x1f5/0x2a0
[ 449.890498] ? btrfs_decode_error+0x40/0x40
[ 449.890510] ? find_next_bit+0x57/0x90
[ 449.890517] ? cpumask_next+0x1a/0x20
[ 449.890522] ? pcpu_alloc+0x449/0x8c0
[ 449.890528] ? pcpu_free_area+0x410/0x410
[ 449.890534] ? memcg_kmem_put_cache+0x1b/0xa0
[ 449.890540] ? memcpy+0x45/0x50
[ 449.890547] mount_fs+0x60/0x1a0
[ 449.890553] ? btrfs_decode_error+0x40/0x40
[ 449.890558] ? mount_fs+0x60/0x1a0
[ 449.890565] ? alloc_vfsmnt+0x309/0x360
[ 449.890570] vfs_kern_mount+0x6b/0x1a0
[ 449.890576] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 449.890583] btrfs_mount+0x209/0xb71
[ 449.890589] ? pcpu_block_update_hint_alloc+0x1f5/0x2a0
[ 449.890595] ? btrfs_remount+0x8e0/0x8e0
[ 449.890601] ? find_next_zero_bit+0x2c/0xa0
[ 449.890608] ? find_next_bit+0x57/0x90
[ 449.890613] ? cpumask_next+0x1a/0x20
[ 449.890617] ? pcpu_alloc+0x449/0x8c0
[ 449.890624] ? pcpu_free_area+0x410/0x410
[ 449.890629] ? memcg_kmem_put_cache+0x1b/0xa0
[ 449.890634] ? memcpy+0x45/0x50
[ 449.890641] mount_fs+0x60/0x1a0
[ 449.890646] ? btrfs_remount+0x8e0/0x8e0
[ 449.890652] ? mount_fs+0x60/0x1a0
[ 449.890656] ? alloc_vfsmnt+0x309/0x360
[ 449.890662] vfs_kern_mount+0x6b/0x1a0
[ 449.890668] do_mount+0x34a/0x18a0
[ 449.890673] ? lockref_put_or_lock+0xcf/0x160
[ 449.890680] ? copy_mount_string+0x20/0x20
[ 449.890685] ? memcg_kmem_put_cache+0x1b/0xa0
[ 449.890691] ? kasan_check_write+0x14/0x20
[ 449.890696] ? _copy_from_user+0x6a/0x90
[ 449.890702] ? memdup_user+0x42/0x60
[ 449.890708] ksys_mount+0x83/0xd0
[ 449.890714] __x64_sys_mount+0x67/0x80
[ 449.890723] do_syscall_64+0x78/0x170
[ 449.890729] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 449.890734] RIP: 0033:0x7fc36964fb9a
[ 449.890737] RSP: 002b:00007ffd268892f8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
[ 449.890744] RAX: ffffffffffffffda RBX: 0000000000e7f030 RCX: 00007fc36964fb9a
[ 449.890747] RDX: 0000000000e7f210 RSI: 0000000000e80f30 RDI: 0000000000e87ec0
[ 449.890750] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000014
[ 449.890753] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000000000e87ec0
[ 449.890756] R13: 0000000000e7f210 R14: 0000000000000000 R15: 0000000000000003
[ 449.891109] Allocated by task 1291:
[ 449.891832] save_stack+0x46/0xd0
[ 449.891838] kasan_kmalloc+0xad/0xe0
[ 449.891843] kasan_slab_alloc+0x11/0x20
[ 449.891848] kmem_cache_alloc+0xd1/0x1e0
[ 449.891854] __btrfs_add_free_space+0x43/0x5e0
[ 449.891859] add_new_free_space+0x22b/0x240
[ 449.891864] btrfs_read_block_groups+0xae3/0xc60
[ 449.891868] open_ctree+0x2cfc/0x3ce9
[ 449.891873] btrfs_mount_root+0xae6/0xc60
[ 449.891878] mount_fs+0x60/0x1a0
[ 449.891883] vfs_kern_mount+0x6b/0x1a0
[ 449.891888] btrfs_mount+0x209/0xb71
[ 449.891893] mount_fs+0x60/0x1a0
[ 449.891897] vfs_kern_mount+0x6b/0x1a0
[ 449.891902] do_mount+0x34a/0x18a0
[ 449.891906] ksys_mount+0x83/0xd0
[ 449.891911] __x64_sys_mount+0x67/0x80
[ 449.891916] do_syscall_64+0x78/0x170
[ 449.891921] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 449.892235] Freed by task 1291:
[ 449.892866] save_stack+0x46/0xd0
[ 449.892872] __kasan_slab_free+0x13c/0x1a0
[ 449.892877] kasan_slab_free+0xe/0x10
[ 449.892882] kmem_cache_free+0x89/0x1e0
[ 449.892888] try_merge_free_space+0x274/0x2e0
[ 449.892894] __btrfs_add_free_space+0x96/0x5e0
[ 449.892898] unpin_extent_range+0x376/0x670
[ 449.892904] btrfs_finish_extent_commit+0x15b/0x490
[ 449.892909] btrfs_commit_transaction+0xaf4/0xfa0
[ 449.892913] btrfs_create_uuid_tree+0x6a/0x170
[ 449.892917] open_ctree+0x3b26/0x3ce9
[ 449.892922] btrfs_mount_root+0xae6/0xc60
[ 449.892927] mount_fs+0x60/0x1a0
[ 449.892932] vfs_kern_mount+0x6b/0x1a0
[ 449.892937] btrfs_mount+0x209/0xb71
[ 449.892942] mount_fs+0x60/0x1a0
[ 449.892946] vfs_kern_mount+0x6b/0x1a0
[ 449.892951] do_mount+0x34a/0x18a0
[ 449.892955] ksys_mount+0x83/0xd0
[ 449.892960] __x64_sys_mount+0x67/0x80
[ 449.892965] do_syscall_64+0x78/0x170
[ 449.892970] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 449.893286] The buggy address belongs to the object at ffff8801ed10f000
which belongs to the cache btrfs_free_space of size 72
[ 449.895793] The buggy address is located 48 bytes inside of
72-byte region [ffff8801ed10f000, ffff8801ed10f048)
[ 449.898035] The buggy address belongs to the page:
[ 449.898979] page:ffffea0007b443c0 count:1 mapcount:0 mapping:0000000000000000 index:0x0
[ 449.900562] flags: 0x2ffff0000000100(slab)
[ 449.901379] raw: 02ffff0000000100 0000000000000000 0000000000000000 0000000180270027
[ 449.902881] raw: dead000000000100 dead000000000200 ffff8801e0a676c0 0000000000000000
[ 449.904396] page dumped because: kasan: bad access detected
[ 449.905800] Memory state around the buggy address:
[ 449.906748] ffff8801ed10ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 449.908165] ffff8801ed10ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 449.909577] >ffff8801ed10f000: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
[ 449.910969] ^
[ 449.911933] ffff8801ed10f080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 449.913328] ffff8801ed10f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 449.914720] ==================================================================
[ 449.916119] Disabling lock debugging due to kernel taint
No kernel crash on plain kernel.
- Reason
https://elixir.bootlin.com/linux/v4.17-rc5/source/fs/btrfs/free-space-cache.c#L2161
if (left_info && !left_info->bitmap &&
left_info->offset + left_info->bytes == offset) {
if (update_stat)
unlink_free_space(ctl, left_info);
else
__unlink_free_space(ctl, left_info);
info->offset = left_info->offset;
info->bytes += left_info->bytes;
kmem_cache_free(btrfs_free_space_cachep, left_info);
merged = true;
}
return merged;
Regarding KASAN report, left_info is already freed but referenced (->bitmap). It is in fact freed just several lines after, namely kmem_cache_free(btrfs_free_space_cachep, left_info);
Found by Wen Xu and Po-Ning Tseng from SSLab, Gatech.
===== Extra info for btrfs-progs =====
This image could cause btrfs-progs to BUG_ON() when opening the image.
Fixed by "btrfs-progs: Don't BUG_ON() if we failed to load one device or one
chunk".
|
