Bug 154021 - Fuzzed image causes segmentation fault in btrfsck
Summary: Fuzzed image causes segmentation fault in btrfsck
Status: RESOLVED CODE_FIX
Alias: None
Product: File System
Classification: Unclassified
Component: btrfs (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: Josef Bacik
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-26 22:53 UTC by Lukas Lueg
Modified: 2016-08-30 14:51 UTC (History)
2 users (show)

See Also:
Kernel Version: 4.6.6-300.fc24-x86_64
Subsystem:
Regression: No
Bisected commit-id:


Attachments
Image triggering btrfsck to segv (17.74 KB, application/gzip)
2016-08-26 22:53 UTC, Lukas Lueg
Details
Full ASAN-Log (8.11 KB, text/x-log)
2016-08-26 22:54 UTC, Lukas Lueg
Details

Description Lukas Lueg 2016-08-26 22:53:42 UTC
Created attachment 230361 [details]
Image triggering btrfsck to segv

The fuzzer hit again:

==32522==ERROR: AddressSanitizer: SEGV on unknown address 0x00027fff801c (pc 0x0000004a952e bp 0x7fff5222ce70 sp 0x7fff5222c600 T0)
    #0 0x4a952d in __asan_memcpy (/home/lukas/dev/btrfsfuzz/bin-asan/bin/btrfs+0x4a952d)
    #1 0x66a323 in read_extent_buffer /home/lukas/dev/btrfsfuzz/src-asan/extent_io.c:867:2
    #2 0x55ad25 in btrfs_node_key /home/lukas/dev/btrfsfuzz/src-asan/./ctree.h:1668:2
    #3 0x58573b in check_fs_root /home/lukas/dev/btrfsfuzz/src-asan/cmds-check.c:3748:3
    #4 0x544136 in check_fs_roots /home/lukas/dev/btrfsfuzz/src-asan/cmds-check.c:3896:10
    #5 0x53d8c5 in cmd_check /home/lukas/dev/btrfsfuzz/src-asan/cmds-check.c:11470:8
    #6 0x4f105f in main /home/lukas/dev/btrfsfuzz/src-asan/btrfs.c:243:8
    #7 0x7fea1bcb7730 in __libc_start_main (/lib64/libc.so.6+0x20730)
    #8 0x421238 in _start (/home/lukas/dev/btrfsfuzz/bin-asan/bin/btrfs+0x421238)


See the attached image to reproduce using btrfs-progs btrfs-progs v4.7-42-g56e9586.
Comment 1 Lukas Lueg 2016-08-26 22:54:32 UTC
Created attachment 230371 [details]
Full ASAN-Log
Comment 2 Qu Wenruo 2016-08-30 07:26:31 UTC
Root fix for btrfsck:
https://patchwork.kernel.org/patch/9304945/

Along with early warning patch, could just ignore such unaligend extent bytenr
https://patchwork.kernel.org/patch/9304947/
Comment 3 David Sterba 2016-08-30 14:51:09 UTC
Fixes and image are in git, will be part of the next release. Closing, thanks.

Note You need to log in before you can comment on or make changes to this bug.