Created attachment 300593 [details] poc and .config - Overview general protection fault at fs/btrfs/treelog.c: btrfs_check_ref_name_override() when mount and operate on a corrupted image - Reproduce tested on kernel 5.17-rc8, 5.17 # mkdir test_crash # cd test_crash # unzip tmp5.zip # mkdir mnt # ./single_test.sh btrfs 5 - Kernel dump [ 303.211688] loop0: detected capacity change from 0 to 262144 [ 303.234718] BTRFS info (device loop0): disk space caching is enabled [ 303.234723] BTRFS info (device loop0): has skinny extents [ 303.235685] BTRFS critical (device loop0): corrupt leaf: root=2 block=29421568 slot=5, bad key order, prev (281475006074880 169 0) current (29376512 169 0) [ 303.235758] BTRFS error (device loop0): block=29421568 read time tree block corruption detected [ 303.236021] BTRFS info (device loop0): read error corrected: ino 0 off 29421568 (dev /dev/loop0 sector 73848) [ 303.236361] BTRFS info (device loop0): creating UUID tree [ 303.246412] BTRFS info (device loop0): checking UUID tree [ 303.369948] BTRFS warning (device loop0): bad eb member start: ptr 0xff3 start 29618176 member offset 4099 size 2 [ 303.369985] general protection fault, probably for non-canonical address 0x5e6cc00000003: 0000 [#1] PREEMPT SMP NOPTI [ 303.370032] CPU: 3 PID: 2334 Comm: tmp5 Tainted: G W 5.17.0-rc8 #1 [ 303.370058] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 303.371346] RIP: 0010:btrfs_get_16+0x93/0x140 [ 303.372657] Code: 8b 46 70 48 2b 05 7d 17 0b 01 48 c1 f8 06 48 c1 e0 0c 48 03 05 7e 17 0b 01 48 89 c3 e8 46 fa ff ff 49 81 fc ff 0f 00 00 74 2c <42> 0f b7 04 23 48 83 05 18 72 16 02 01 48 8b 4c 24 10 65 48 33 0c [ 303.375282] RSP: 0018:ffffad12406af8d8 EFLAGS: 00010293 [ 303.376585] RAX: 0000000000000000 RBX: 0005e6cc00000000 RCX: 0000000000000001 [ 303.377850] RDX: 0000000000000000 RSI: ffffffff98bc25b1 RDI: 00000000ffffffff [ 303.379139] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 303.380457] R10: 0000000000000000 R11: 0000000000000034 R12: 0000000000000003 [ 303.381761] R13: ffff888d068cc300 R14: ffff888d068cc308 R15: 0000000000000ff3 [ 303.383020] FS: 00007f60c96634c0(0000) GS:ffff888ef5d80000(0000) knlGS:0000000000000000 [ 303.384216] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 303.385425] CR2: 00007ffdd0c7a000 CR3: 000000010d436006 CR4: 0000000000370ee0 [ 303.386579] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 303.387867] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 303.389021] Call Trace: [ 303.390271] <TASK> [ 303.391471] btrfs_check_ref_name_override.isra.22+0x113/0x320 [ 303.392591] log_conflicting_inodes+0x337/0x550 [ 303.393758] btrfs_log_inode+0xdb1/0x1a30 [ 303.394923] ? kmem_cache_free+0x90/0x310 [ 303.396039] btrfs_log_inode_parent+0x2b2/0x1470 [ 303.397155] ? btrfs_delayed_update_inode+0x9c/0x350 [ 303.398396] ? btrfs_update_root_times+0x7b/0xb0 [ 303.399524] ? preempt_count_add+0x68/0xa0 [ 303.400578] ? _raw_spin_lock+0x13/0x30 [ 303.401581] ? _raw_spin_unlock+0x16/0x30 [ 303.402615] ? btrfs_update_inode+0x155/0x170 [ 303.403623] ? btrfs_add_link+0x1a7/0x7b0 [ 303.404623] btrfs_log_new_name+0x165/0x1d0 [ 303.405599] btrfs_rename2+0x1250/0x2620 [ 303.406527] ? vfs_rename+0x6f4/0x9e0 [ 303.407418] vfs_rename+0x6f4/0x9e0 [ 303.408311] ? tomoyo_path_rename+0x44/0x60 [ 303.409180] ? do_renameat2+0x751/0x770 [ 303.410024] do_renameat2+0x751/0x770 [ 303.410895] __x64_sys_rename+0x5f/0x80 [ 303.411736] do_syscall_64+0x37/0xb0 [ 303.412580] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 303.413419] RIP: 0033:0x7f60c916d539 [ 303.414261] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f9 2c 00 f7 d8 64 89 01 48 [ 303.415834] RSP: 002b:00007ffdd0c75958 EFLAGS: 00000207 ORIG_RAX: 0000000000000052 [ 303.416589] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f60c916d539 [ 303.417298] RDX: 00007f60c916d539 RSI: 00007ffdd0c76b00 RDI: 00007ffdd0c75e80 [ 303.418024] RBP: 00007ffdd0c7db40 R08: 00007ffdd0c7dc28 R09: 00007ffdd0c7dc28 [ 303.418761] R10: 00007ffdd0c7dc28 R11: 0000000000000207 R12: 000055dae80005f0 [ 303.419455] R13: 00007ffdd0c7dc20 R14: 0000000000000000 R15: 0000000000000000 [ 303.420133] </TASK> [ 303.420774] Modules linked in: iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi joydev xfs input_leds serio_raw qemu_fw_cfg autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear hid_generic usbhid hid qxl drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd psmouse cryptd [ 303.423647] ---[ end trace 0000000000000000 ]--- [ 303.424360] RIP: 0010:btrfs_get_16+0x93/0x140 [ 303.425087] Code: 8b 46 70 48 2b 05 7d 17 0b 01 48 c1 f8 06 48 c1 e0 0c 48 03 05 7e 17 0b 01 48 89 c3 e8 46 fa ff ff 49 81 fc ff 0f 00 00 74 2c <42> 0f b7 04 23 48 83 05 18 72 16 02 01 48 8b 4c 24 10 65 48 33 0c [ 303.426708] RSP: 0018:ffffad12406af8d8 EFLAGS: 00010293 [ 303.427492] RAX: 0000000000000000 RBX: 0005e6cc00000000 RCX: 0000000000000001 [ 303.428275] RDX: 0000000000000000 RSI: ffffffff98bc25b1 RDI: 00000000ffffffff [ 303.429045] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 [ 303.429859] R10: 0000000000000000 R11: 0000000000000034 R12: 0000000000000003 [ 303.430629] R13: ffff888d068cc300 R14: ffff888d068cc308 R15: 0000000000000ff3 [ 303.431393] FS: 00007f60c96634c0(0000) GS:ffff888ef5d80000(0000) knlGS:0000000000000000 [ 303.432207] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 303.433044] CR2: 00007ffdd0c7a000 CR3: 000000010d436006 CR4: 0000000000370ee0 [ 303.433905] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 303.434716] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Is this a regression or did this happen with earlier kernels (say 5.16) as well?
(In reply to The Linux kernel's regression tracker (Thorsten Leemhuis) from comment #1) > Is this a regression or did this happen with earlier kernels (say 5.16) as > well? Other than 5.17, I tested on 5.16.8, 5.15.32, 5.10.99 and 5.4.171 The general page fault is triggered on 5.16.8, 5.15.32, but not on 5.10.99 or 5.4.171 5.10.99 and 5.4.171 only post some warnings: [ 32.263551] BTRFS: device fsid a62e00e8-e94e-4200-8217-12444de93c2e devid 1 transid 8 /dev/loop0 scanned by mount (898) [ 32.265601] BTRFS info (device loop0): disk space caching is enabled [ 32.265602] BTRFS info (device loop0): has skinny extents [ 32.268929] BTRFS critical (device loop0): corrupt leaf: root=2 block=29421568 slot=5, bad key order, prev (281475006074880 169 0) current (29376512 169 0) [ 32.269035] BTRFS error (device loop0): block=29421568 read time tree block corruption detected [ 32.269625] BTRFS info (device loop0): read error corrected: ino 0 off 29421568 (dev /dev/loop0 sector 73848) [ 32.270039] BTRFS info (device loop0): creating UUID tree [ 32.823794] ------------[ cut here ]------------ [ 32.823802] WARNING: CPU: 2 PID: 939 at fs/btrfs/block-rsv.c:448 btrfs_release_global_block_rsv+0xa4/0xc0 [ 32.823807] Modules linked in: iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi xfs joydev input_leds serio_raw qemu_fw_cfg autofs4 raid10 raid456 hid_generic usbhid hid async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear qxl drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel glue_helper psmouse crypto_simd cryptd [ 32.823845] CPU: 2 PID: 939 Comm: umount Not tainted 5.10.99 #1 [ 32.823846] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 32.823848] RIP: 0010:btrfs_release_global_block_rsv+0xa4/0xc0 [ 32.823850] Code: 01 00 00 00 74 b2 0f 0b 48 83 bb 68 01 00 00 00 74 b0 0f 0b 48 83 bb 70 01 00 00 00 74 ae 0f 0b 48 83 bb a0 01 00 00 00 74 ac <0f> 0b 48 83 bb a8 01 00 00 00 74 aa 0f 0b 48 83 bb e0 01 00 00 00 [ 32.823851] RSP: 0018:ffffae7f4087fde8 EFLAGS: 00010206 [ 32.823853] RAX: 00000000000d0000 RBX: ffff965f86157000 RCX: ffff965f84f05800 [ 32.823854] RDX: 0000000000000001 RSI: ffff965f84f05800 RDI: ffff965f84f05800 [ 32.823855] RBP: ffff965f86157088 R08: 0000000000000000 R09: ffffffff90444800 [ 32.823856] R10: ffff965f84f06400 R11: 0000000000000000 R12: ffff965f861576a0 [ 32.823857] R13: ffff965f86157098 R14: 0000000000000000 R15: dead000000000100 [ 32.823858] FS: 00007fa54aeaf080(0000) GS:ffff966175d00000(0000) knlGS:0000000000000000 [ 32.823859] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.823860] CR2: 000055b46340e068 CR3: 00000001041d4005 CR4: 0000000000370ee0 [ 32.823863] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.823864] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.823865] Call Trace: [ 32.823874] btrfs_free_block_groups+0x1d1/0x280 [ 32.823877] close_ctree+0x26e/0x2ae [ 32.823879] generic_shutdown_super+0x6c/0x120 [ 32.823883] kill_anon_super+0xe/0x30 [ 32.823885] btrfs_kill_super+0x12/0x20 [ 32.823887] deactivate_locked_super+0x3f/0x70 [ 32.823889] cleanup_mnt+0xb4/0x140 [ 32.823891] task_work_run+0x76/0xb0 [ 32.823894] exit_to_user_mode_prepare+0x127/0x130 [ 32.823896] syscall_exit_to_user_mode+0x28/0x140 [ 32.823898] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 32.823903] RIP: 0033:0x7fa54a76f657 [ 32.823906] Code: 98 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 01 98 2c 00 f7 d8 64 89 01 48 [ 32.823908] RSP: 002b:00007ffeaef0c5c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.823912] RAX: 0000000000000000 RBX: 000055b463406420 RCX: 00007fa54a76f657 [ 32.823913] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055b46340e0b0 [ 32.823914] RBP: 0000000000000000 R08: 000055b46340e580 R09: 0000000000000005 [ 32.823914] R10: 000000000000000b R11: 0000000000000246 R12: 000055b46340e0b0 [ 32.823915] R13: 00007fa54ac918a4 R14: 000055b463406600 R15: 0000000000000000 [ 32.823917] ---[ end trace 52d1c675ac0cc557 ]--- [ 32.823928] ------------[ cut here ]------------ [ 32.823931] WARNING: CPU: 2 PID: 939 at fs/btrfs/block-rsv.c:449 btrfs_release_global_block_rsv+0xb0/0xc0 [ 32.823931] Modules linked in: iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi xfs joydev input_leds serio_raw qemu_fw_cfg autofs4 raid10 raid456 hid_generic usbhid hid async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear qxl drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel glue_helper psmouse crypto_simd cryptd [ 32.823955] CPU: 2 PID: 939 Comm: umount Tainted: G W 5.10.99 #1 [ 32.823956] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 32.823958] RIP: 0010:btrfs_release_global_block_rsv+0xb0/0xc0 [ 32.823959] Code: 01 00 00 00 74 b0 0f 0b 48 83 bb 70 01 00 00 00 74 ae 0f 0b 48 83 bb a0 01 00 00 00 74 ac 0f 0b 48 83 bb a8 01 00 00 00 74 aa <0f> 0b 48 83 bb e0 01 00 00 00 74 a8 0f 0b eb a4 0f 1f 44 00 00 41 [ 32.823960] RSP: 0018:ffffae7f4087fde8 EFLAGS: 00010206 [ 32.823961] RAX: 00000000000d0000 RBX: ffff965f86157000 RCX: ffff965f84f05800 [ 32.823962] RDX: 0000000000000001 RSI: ffff965f84f05800 RDI: ffff965f84f05800 [ 32.823963] RBP: ffff965f86157088 R08: 0000000000000000 R09: ffffffff90444800 [ 32.823964] R10: ffff965f84f06400 R11: 0000000000000000 R12: ffff965f861576a0 [ 32.823965] R13: ffff965f86157098 R14: 0000000000000000 R15: dead000000000100 [ 32.823967] FS: 00007fa54aeaf080(0000) GS:ffff966175d00000(0000) knlGS:0000000000000000 [ 32.823968] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.823968] CR2: 000055b46340e068 CR3: 00000001041d4005 CR4: 0000000000370ee0 [ 32.823971] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.823972] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.823973] Call Trace: [ 32.823975] btrfs_free_block_groups+0x1d1/0x280 [ 32.823977] close_ctree+0x26e/0x2ae [ 32.823978] generic_shutdown_super+0x6c/0x120 [ 32.823980] kill_anon_super+0xe/0x30 [ 32.823981] btrfs_kill_super+0x12/0x20 [ 32.823982] deactivate_locked_super+0x3f/0x70 [ 32.823984] cleanup_mnt+0xb4/0x140 [ 32.823986] task_work_run+0x76/0xb0 [ 32.823987] exit_to_user_mode_prepare+0x127/0x130 [ 32.823989] syscall_exit_to_user_mode+0x28/0x140 [ 32.823990] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 32.823991] RIP: 0033:0x7fa54a76f657 [ 32.823993] Code: 98 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 01 98 2c 00 f7 d8 64 89 01 48 [ 32.823993] RSP: 002b:00007ffeaef0c5c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.823995] RAX: 0000000000000000 RBX: 000055b463406420 RCX: 00007fa54a76f657 [ 32.823996] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055b46340e0b0 [ 32.823997] RBP: 0000000000000000 R08: 000055b46340e580 R09: 0000000000000005 [ 32.823997] R10: 000000000000000b R11: 0000000000000246 R12: 000055b46340e0b0 [ 32.823998] R13: 00007fa54ac918a4 R14: 000055b463406600 R15: 0000000000000000 [ 32.824000] ---[ end trace 52d1c675ac0cc558 ]--- [ 32.824014] ------------[ cut here ]------------ [ 32.824016] WARNING: CPU: 2 PID: 939 at fs/btrfs/block-group.c:3393 btrfs_free_block_groups+0x1f7/0x280 [ 32.824017] Modules linked in: iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi xfs joydev input_leds serio_raw qemu_fw_cfg autofs4 raid10 raid456 hid_generic usbhid hid async_raid6_recov async_memcpy async_pq async_xor async_tx raid1 raid0 multipath linear qxl drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel glue_helper psmouse crypto_simd cryptd [ 32.824042] CPU: 2 PID: 939 Comm: umount Tainted: G W 5.10.99 #1 [ 32.824043] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 32.824045] RIP: 0010:btrfs_free_block_groups+0x1f7/0x280 [ 32.824046] Code: ef 95 ff ff 48 8b 83 a0 06 00 00 49 39 c4 0f 84 87 00 00 00 49 be 00 01 00 00 00 00 ad de 49 bd 22 01 00 00 00 00 ad de eb 43 <0f> 0b 31 c9 31 d2 4c 89 fe 48 89 df e8 08 87 ff ff 48 83 7d 40 00 [ 32.824047] RSP: 0018:ffffae7f4087fdf8 EFLAGS: 00010206 [ 32.824049] RAX: ffff965f84f05888 RBX: ffff965f86157000 RCX: 000000008010000c [ 32.824049] RDX: 000000008010000d RSI: 0000000000000001 RDI: ffffffff913ade46 [ 32.824050] RBP: ffff965f84f05888 R08: 0000000000000000 R09: ffffffff90604900 [ 32.824051] R10: ffff965f84f05000 R11: 0000000000000001 R12: ffff965f861576a0 [ 32.824052] R13: dead000000000122 R14: dead000000000100 R15: ffff965f84f05800 [ 32.824053] FS: 00007fa54aeaf080(0000) GS:ffff966175d00000(0000) knlGS:0000000000000000 [ 32.824054] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.824055] CR2: 000055b46340e068 CR3: 00000001041d4005 CR4: 0000000000370ee0 [ 32.824058] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 32.824059] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 32.824059] Call Trace: [ 32.824062] close_ctree+0x26e/0x2ae [ 32.824063] generic_shutdown_super+0x6c/0x120 [ 32.824064] kill_anon_super+0xe/0x30 [ 32.824065] btrfs_kill_super+0x12/0x20 [ 32.824067] deactivate_locked_super+0x3f/0x70 [ 32.824068] cleanup_mnt+0xb4/0x140 [ 32.824070] task_work_run+0x76/0xb0 [ 32.824071] exit_to_user_mode_prepare+0x127/0x130 [ 32.824073] syscall_exit_to_user_mode+0x28/0x140 [ 32.824074] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 32.824075] RIP: 0033:0x7fa54a76f657 [ 32.824077] Code: 98 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 01 98 2c 00 f7 d8 64 89 01 48 [ 32.824077] RSP: 002b:00007ffeaef0c5c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 32.824079] RAX: 0000000000000000 RBX: 000055b463406420 RCX: 00007fa54a76f657 [ 32.824080] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055b46340e0b0 [ 32.824081] RBP: 0000000000000000 R08: 000055b46340e580 R09: 0000000000000005 [ 32.824081] R10: 000000000000000b R11: 0000000000000246 R12: 000055b46340e0b0 [ 32.824082] R13: 00007fa54ac918a4 R14: 000055b463406600 R15: 0000000000000000 [ 32.824084] ---[ end trace 52d1c675ac0cc559 ]--- [ 32.824086] BTRFS info (device loop0): space_info 4 has 33349632 free, is not full [ 32.824088] BTRFS info (device loop0): space_info total=33554432, used=73728, pinned=0, reserved=0, may_use=65536, readonly=65536 [ 32.824089] BTRFS info (device loop0): global_block_rsv: size 0 reserved 0 [ 32.824090] BTRFS info (device loop0): trans_block_rsv: size 0 reserved 0 [ 32.824091] BTRFS info (device loop0): chunk_block_rsv: size 0 reserved 0 [ 32.824092] BTRFS info (device loop0): delayed_block_rsv: size 65536 reserved 65536 [ 32.824093] BTRFS info (device loop0): delayed_refs_rsv: size 0 reserved 0