Bug 155621 - Fuzzed image causes btrfsck to enter endless loop (no output)
Summary: Fuzzed image causes btrfsck to enter endless loop (no output)
Status: RESOLVED CODE_FIX
Alias: None
Product: File System
Classification: Unclassified
Component: btrfs (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: Josef Bacik
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-30 16:07 UTC by Lukas Lueg
Modified: 2016-09-09 13:29 UTC (History)
2 users (show)

See Also:
Kernel Version: 4.6.6-300.fc24-x86_64
Subsystem:
Regression: No
Bisected commit-id:


Attachments
btrfs-image causing endless loop in btrfsck (17.70 KB, application/x-gzip)
2016-08-30 16:07 UTC, Lukas Lueg
Details
GDB log interrupting btrfsck within endless loop (1.62 KB, text/plain)
2016-08-30 16:08 UTC, Lukas Lueg
Details
[PATCH] btrfsprogs: avoid looping forever when a bad blockgroup key is found (1.21 KB, patch)
2016-09-06 21:06 UTC, Jeff Mahoney
Details | Diff

Description Lukas Lueg 2016-08-30 16:07:36 UTC
Created attachment 231441 [details]
btrfs-image causing endless loop in btrfsck

More news from the fuzzer. The attached image causes btrfsck to enter what seems to be an endless loop; using btrfs-progs v4.7-42-g56e9586.
Comment 1 Lukas Lueg 2016-08-30 16:08:15 UTC
Created attachment 231451 [details]
GDB log interrupting btrfsck within endless loop
Comment 2 Jeff Mahoney 2016-09-06 21:05:44 UTC
This one happens when found_key.offset is 0.  Key never advances and found_key.offset never changes, so we just loop forever.
Comment 3 Jeff Mahoney 2016-09-06 21:06:44 UTC
Created attachment 232291 [details]
[PATCH] btrfsprogs: avoid looping forever when a bad blockgroup key is found

If we discover a bad BLOCK_GROUP_ITEM_KEY with offset = 0, we'll end up
looping forever when we read the block groups in.  This is due to the
search for the next block group starting at the current object + the
offset.  If offset is 0, we'll just get the same key over and over
and never advance.  This patch ensures that we'll advance at least one
objectid per iteration.
Comment 4 Lukas Lueg 2016-09-07 05:09:17 UTC
Shouldn't there be a warning if found_key.offset == 0 ?
Comment 5 Jeff Mahoney 2016-09-07 05:28:06 UTC
That's the job of the checker.
Comment 6 David Sterba 2016-09-09 13:29:55 UTC
Patch merged, image added to the testsuite.

Note You need to log in before you can comment on or make changes to this bug.