Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.7. Attached to the email were a PoC file of the issue.
Stack dump:
snapshot points to missing/incorrect tree:
u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing
=============================
WARNING: suspicious RCU usage
6.7.0 #2 Not tainted
-----------------------------
fs/bcachefs/snapshot.h:41 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
5 locks held by syz-executor.2/71285:
#0: ffff888073700268 (&c->state_lock){+.+.}-{3:3}, at: bch2_fs_start+0x97/0x5e0 fs/bcachefs/super.c:956
#1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:116 [inline]
#1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:215 [inline]
#1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: __bch2_trans_get+0x594/0x950 fs/bcachefs/btree_iter.c:3020
#2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline]
#2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline]
#2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline]
#2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146
#3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline]
#3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline]
#3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline]
#3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146
#4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline]
#4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline]
#4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline]
#4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146
stack backtrace:
CPU: 1 PID: 71285 Comm: syz-executor.2 Not tainted 6.7.0 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106
lockdep_rcu_suspicious+0x207/0x3b0 kernel/locking/lockdep.c:6712
snapshot_t fs/bcachefs/snapshot.h:41 [inline]
bch2_snapshot_tree_oldest_subvol+0x919/0xc40 fs/bcachefs/snapshot.c:445
snapshot_tree_ptr_repair+0x642/0x1e40 fs/bcachefs/snapshot.c:685
check_snapshot+0x1737/0x2640 fs/bcachefs/snapshot.c:808
bch2_check_snapshots+0x2da/0x5c0 fs/bcachefs/snapshot.c:867
bch2_run_recovery_pass fs/bcachefs/recovery.c:655 [inline]
bch2_run_recovery_passes+0x2ba/0x510 fs/bcachefs/recovery.c:672
bch2_fs_recovery+0x36fe/0x52d0 fs/bcachefs/recovery.c:918
bch2_fs_start+0x365/0x5e0 fs/bcachefs/super.c:978
bch2_fs_open+0x1ac9/0x3890 fs/bcachefs/super.c:1968
bch2_mount+0x538/0x13c0 fs/bcachefs/fs.c:1863
legacy_get_tree+0x109/0x220 fs/fs_context.c:662
vfs_get_tree+0x93/0x380 fs/super.c:1771
do_new_mount fs/namespace.c:3337 [inline]
path_mount+0x679/0x1e40 fs/namespace.c:3664
do_mount fs/namespace.c:3677 [inline]
__do_sys_mount fs/namespace.c:3886 [inline]
__se_sys_mount fs/namespace.c:3863 [inline]
__x64_sys_mount+0x287/0x310 fs/namespace.c:3863
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x43/0x120 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7fe38c291b3e
Code: 48 c7 c0 ff ff ff ff eb aa e8 be 0d 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe38cf6ee38 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00000000000119fc RCX: 00007fe38c291b3e
RDX: 0000000020011a00 RSI: 0000000020000040 RDI: 00007fe38cf6ee90
RBP: 00007fe38cf6eed0 R08: 00007fe38cf6eed0 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000202 R12: 0000000020011a00
R13: 0000000020000040 R14: 00007fe38cf6ee90 R15: 0000000020000100
</TASK>
done
bcachefs (loop2): check_subvols... done
bcachefs (loop2): delete_dead_snapshots... done
bcachefs (loop2): resume_logged_ops... done
bcachefs (loop2): check_inodes... done
bcachefs (loop2): check_extents... done
bcachefs (loop2): check_indirect_extents... done
bcachefs (loop2): check_dirents... done
bcachefs (loop2): check_xattrs... done
bcachefs (loop2): check_root... done
bcachefs (loop2): check_directory_structure... done
bcachefs (loop2): check_nlinks... done
bcachefs (loop2): delete_dead_inodes... done
bcachefs (loop2): set_fs_needs_rebalance... done
bcachefs (loop2): Fixed errors, running fsck a second time to verify fs is clean
bcachefs (loop2): check_alloc_info... done
bcachefs (loop2): check_lrus... done
bcachefs (loop2): check_btree_backpointers... done
bcachefs (loop2): check_backpointers_to_extents... done
bcachefs (loop2): check_extents_to_backpointers... done
bcachefs (loop2): check_alloc_to_lru_refs... done
bcachefs (loop2): bucket_gens_init... done
bcachefs (loop2): check_snapshot_trees... done
bcachefs (loop2): check_snapshots... done
bcachefs (loop2): check_subvols... done
bcachefs (loop2): delete_dead_snapshots... done
bcachefs (loop2): resume_logged_ops... done
bcachefs (loop2): check_inodes... done
bcachefs (loop2): check_extents... done
bcachefs (loop2): check_indirect_extents... done
bcachefs (loop2): check_dirents... done
bcachefs (loop2): check_xattrs... done
bcachefs (loop2): check_root... done
bcachefs (loop2): check_directory_structure... done
bcachefs (loop2): check_nlinks... done
bcachefs (loop2): delete_dead_inodes... done
bcachefs (loop2): set_fs_needs_rebalance... done
bcachefs (loop2): flushing journal and stopping allocators, journal seq 11
bcachefs (loop2): flushing journal and stopping allocators complete, journal seq 11
bcachefs (loop2): marking filesystem clean
Thank you for taking the time to read this email and we look forward to working with you further.