Created attachment 282297 [details] The (compressed) crafted image which causes crash - Overview When mounting the attached crafted image, following errors are reported. Additionally, it hangs on sync after trying to mount. The image is intentionally fuzzed from a normal btrfs image for testing. Compile options for BTRFS are as follows. CONFIG_BTRFS_FS=y CONFIG_BTRFS_FS_POSIX_ACL=y CONFIG_BTRFS_FS_CHECK_INTEGRITY=y # CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set CONFIG_BTRFS_DEBUG=y CONFIG_BTRFS_ASSERT=y CONFIG_BTRFS_FS_REF_VERIFY=y - Reproduces mkdir test mount -t btrfs tmp.img test sync - Kernel messages [ 42.279691] BTRFS info (device sdb): disk space caching is enabled [ 42.279693] BTRFS info (device sdb): has skinny extents [ 42.280376] BTRFS error (device sdb): bad fsid on block 20975616 [ 42.281686] BTRFS info (device sdb): read error corrected: ino 0 off 20975616 (dev /dev/sdb sector 40968) [ 42.282181] BTRFS critical (device sdb): corrupt leaf: root=2 block=29421568 slot=2, bad key order, prev (72057594058899456 192 8388608) current (20975616 169 0) [ 42.284608] BTRFS info (device sdb): read error corrected: ino 0 off 29421568 (dev /dev/sdb sector 73848) [ 42.284806] BTRFS critical (device sdb): corrupt leaf: root=4 block=29396992 slot=5, unexpected item end, have 2181825088 expect 3763 [ 42.286973] BTRFS info (device sdb): read error corrected: ino 0 off 29396992 (dev /dev/sdb sector 73800) [ 42.287507] BTRFS warning (device sdb): mismatching generation and generation_v2 found in root item. This root was probably mounted with an older kernel. Resetting all new fields. [ 42.287753] BTRFS error (device sdb): bad tree block start, want 29380608 have 0 [ 42.289334] BTRFS info (device sdb): read error corrected: ino 0 off 29380608 (dev /dev/sdb sector 73768) [ 42.295096] ------------[ cut here ]------------ [ 42.295098] kernel BUG at fs/btrfs/extent-tree.c:9312! [ 42.295848] invalid opcode: 0000 [#1] SMP PTI [ 42.296454] CPU: 0 PID: 1896 Comm: mount Not tainted 5.0.0 #11 [ 42.297257] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 [ 42.298551] RIP: 0010:btrfs_drop_snapshot+0x601/0x7f0 [ 42.299254] Code: e9 c1 fd ff ff 48 89 ef 4c 89 3c 24 89 44 24 10 e8 64 eb fe ff 44 8b 4c 24 10 41 83 f9 f5 41 0f 95 c4 45 31 f6 e9 89 fc ff ff <0f> 0b 83 bb 94 00 00 00 01 4c 89 3c 24 0f 85 fc 00 00 00 48 89 ef [ 42.301774] RSP: 0018:ffffa55f00cfb958 EFLAGS: 00010246 [ 42.302490] RAX: 0000000000000000 RBX: ffffa2dceb65b9c0 RCX: 0000000000000040 [ 42.303464] RDX: 0000000000000000 RSI: ffffa2dcf7a2acb0 RDI: 000000000002acb0 [ 42.304435] RBP: ffffa2dceed34070 R08: ffffa2dcf7a2acb0 R09: 0000000000000000 [ 42.305406] R10: ffffe45fc8bb4d00 R11: ffffa2dceb871300 R12: ffffa55f00cfb9f0 [ 42.306379] R13: ffffa2dcebae3800 R14: ffffa2dcebae0d78 R15: ffffa2dcebae3800 [ 42.307357] FS: 00007f4171430840(0000) GS:ffffa2dcf7a00000(0000) knlGS:0000000000000000 [ 42.308460] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.309247] CR2: 00007f30cd904000 CR3: 0000000231b4c004 CR4: 00000000001606f0 [ 42.310218] Call Trace: [ 42.310639] merge_reloc_roots+0xda/0x240 [ 42.311246] btrfs_recover_relocation+0x397/0x430 [ 42.311898] open_ctree+0x1de6/0x2264 [ 42.312408] btrfs_mount_root+0x5ad/0x680 [ 42.312963] ? pcpu_alloc_area+0xc3/0x130 [ 42.313518] ? pcpu_next_unpop+0x32/0x40 [ 42.314061] ? mount_fs+0x4a/0x170 [ 42.314535] ? btrfs_decode_error+0x20/0x20 [ 42.315183] mount_fs+0x4a/0x170 [ 42.315635] vfs_kern_mount+0x5d/0x100 [ 42.316156] btrfs_mount+0x16e/0x8c8 [ 42.316652] ? pcpu_alloc_area+0xc3/0x130 [ 42.317206] ? pcpu_next_unpop+0x32/0x40 [ 42.317748] ? mount_fs+0x4a/0x170 [ 42.318219] mount_fs+0x4a/0x170 [ 42.318715] vfs_kern_mount+0x5d/0x100 [ 42.319269] do_mount+0x200/0xcf0 [ 42.319729] ? memdup_user+0x39/0x60 [ 42.320226] ksys_mount+0x79/0xc0 [ 42.320686] __x64_sys_mount+0x1c/0x20 [ 42.321205] do_syscall_64+0x43/0xf0 [ 42.321703] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 42.322395] RIP: 0033:0x7f4170d0fb9a [ 42.322926] Code: 48 8b 0d 01 c3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ce c2 2b 00 f7 d8 64 89 01 48 [ 42.325449] RSP: 002b:00007fff1f7fc878 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 42.326481] RAX: ffffffffffffffda RBX: 0000000001303050 RCX: 00007f4170d0fb9a [ 42.327507] RDX: 0000000001303230 RSI: 0000000001303f20 RDI: 0000000001303250 [ 42.328477] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000014 [ 42.329446] R10: 00000000c0ed0000 R11: 0000000000000206 R12: 0000000001303250 [ 42.330416] R13: 0000000001303230 R14: 0000000000000000 R15: 0000000000000003 [ 42.331419] Modules linked in: [ 42.331860] ---[ end trace a14aa29d7a6881d8 ]--- [ 42.332507] RIP: 0010:btrfs_drop_snapshot+0x601/0x7f0 [ 42.333207] Code: e9 c1 fd ff ff 48 89 ef 4c 89 3c 24 89 44 24 10 e8 64 eb fe ff 44 8b 4c 24 10 41 83 f9 f5 41 0f 95 c4 45 31 f6 e9 89 fc ff ff <0f> 0b 83 bb 94 00 00 00 01 4c 89 3c 24 0f 85 fc 00 00 00 48 89 ef [ 42.335808] RSP: 0018:ffffa55f00cfb958 EFLAGS: 00010246 [ 42.336529] RAX: 0000000000000000 RBX: ffffa2dceb65b9c0 RCX: 0000000000000040 [ 42.337507] RDX: 0000000000000000 RSI: ffffa2dcf7a2acb0 RDI: 000000000002acb0 [ 42.338486] RBP: ffffa2dceed34070 R08: ffffa2dcf7a2acb0 R09: 0000000000000000 [ 42.339539] R10: ffffe45fc8bb4d00 R11: ffffa2dceb871300 R12: ffffa55f00cfb9f0 [ 42.340513] R13: ffffa2dcebae3800 R14: ffffa2dcebae0d78 R15: ffffa2dcebae3800 [ 42.341491] FS: 00007f4171430840(0000) GS:ffffa2dcf7a00000(0000) knlGS:0000000000000000 [ 42.342621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.343433] CR2: 00007f30cd904000 CR3: 0000000231b4c004 CR4: 00000000001606f0 [ 42.345265] mount (1896) used greatest stack depth: 12872 bytes left
Fixed by 259ee7754b6793af8bdd77f9ca818bc41cfe9541. Thanks for the report.