public inbox for linux-bcachefs@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] bcachefs:fix use-after-free in __bch2_bkey_fsck_err
@ 2025-10-05 16:05 ssrane_b23
       [not found] ` <CANNWa05YhQ9Ycr13e3SOYgD=cms5iskSENUwXUgk0T8zkMy97Q@mail.gmail.com>
  0 siblings, 1 reply; 7+ messages in thread
From: ssrane_b23 @ 2025-10-05 16:05 UTC (permalink / raw)
  To: kent.overstreet
  Cc: linux-bcachefs, linux-kernel, syzbot+55c84106264e92ea9ada,
	Shaurya Rane, syzbot+564efbe31172fe908429

From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>

When mounting a corrupted bcachefs filesystem, KASAN detects a
use-after-free in the error reporting path. This occurs due to a race
between error reporting and key deletion during fsck.

The sequence of events:

1. extent_ptr_validate() detects an invalid extent pointer with a
   corrupt disk offset
2. It calls __bch2_bkey_fsck_err() to report the error
3. The fsck logic decides to delete the corrupt key
4. Meanwhile, __bch2_bkey_fsck_err() calls bch2_bkey_val_to_text()
5. This traverses the extent entries via bch2_extent_ptr_to_text()
6. sector_to_bucket_and_offset() is called with the corrupt offset
7. Memory access occurs on data being concurrently freed

The crash happens in bch2_extent_ptr_to_text() when it attempts to
validate bucket boundaries using already-freed extent pointer data.

Replace bch2_bkey_val_to_text() with bch2_bpos_to_text() to print
only the key position (inode, offset, snapshot) instead of traversing
potentially corrupt or freed extent metadata. The position is part of
the key header and remains safe to read even as the extent data is
being freed. The specific validation error is still printed in the
subsequent lines, providing sufficient context for debugging.

Tested successfully locally using syzbot provided reproducer

Reported-by: syzbot+564efbe31172fe908429@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=564efbe31172fe908429
Fixes: d97de0d017cd ("bcachefs: Make bkey_fsck_err() a wrapper around fsck_err()")
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
---
 fs/bcachefs/error.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/bcachefs/error.c b/fs/bcachefs/error.c
index 267e73d9d7e6..b0bf08915aa2 100644
--- a/fs/bcachefs/error.c
+++ b/fs/bcachefs/error.c
@@ -688,7 +688,7 @@ int __bch2_bkey_fsck_err(struct bch_fs *c,
 	bch2_btree_id_to_text(&buf, from.btree);
 	prt_printf(&buf, " level=%u: ", from.level);
 
-	bch2_bkey_val_to_text(&buf, c, k);
+	bch2_bpos_to_text(&buf, k.k->p);
 	prt_newline(&buf);
 
 	va_list args;
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (4)
@ 2025-09-05 12:19 syzbot
  2025-09-05 16:39 ` syzbot
  2025-11-14 12:17 ` syzbot
  0 siblings, 2 replies; 7+ messages in thread
From: syzbot @ 2025-09-05 12:19 UTC (permalink / raw)
  To: kent.overstreet, linux-bcachefs, linux-kernel, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    d69eb204c255 Merge tag 'net-6.17-rc5' of git://git.kernel...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16d01962580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=bd9738e00c1bbfb4
dashboard link: https://syzkaller.appspot.com/bug?extid=55c84106264e92ea9ada
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1788c962580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12b0887c580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/efa41ea44c52/disk-d69eb204.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/d9ae66f326a4/vmlinux-d69eb204.xz
kernel image: https://storage.googleapis.com/syzbot-assets/967c2253578b/bzImage-d69eb204.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/9e7c59fc7ab3/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+55c84106264e92ea9ada@syzkaller.appspotmail.com

  running recovery passes: check_allocations,check_extents_to_backpointers,check_inodes
bcachefs (loop0): invalid bkey in btree_node btree=inodes level=0: u64s 18 type inode_v3 0:4102:U32_MAX len 0 ver 0: (unpack error)
  invalid variable length fields, deleting
bcachefs (loop0): accounting_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): alloc_read... done
bcachefs (loop0): snapshots_read... done
bcachefs (loop0): check_allocations...
------------[ cut here ]------------
kernel BUG at fs/bcachefs/btree_iter.c:633!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 6000 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:bch2_btree_path_level_init+0xa01/0xa20 fs/bcachefs/btree_iter.c:633
Code: fd 90 0f 0b e8 90 05 a2 fd 90 0f 0b e8 88 05 a2 fd 90 0f 0b e8 80 05 a2 fd 90 0f 0b e8 78 05 a2 fd 90 0f 0b e8 70 05 a2 fd 90 <0f> 0b e8 68 05 a2 fd 90 0f 0b e8 60 05 a2 fd 90 0f 0b 66 66 66 66
RSP: 0018:ffffc90003f8e4a0 EFLAGS: 00010293
RAX: ffffffff841c59a0 RBX: ffff88803d33c2d8 RCX: ffff888030d73b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1007c6c817 R12: 0000000000000052
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  000055557a974500(0000) GS:ffff8881268c1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff395c5f24 CR3: 0000000027dc0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 btree_path_down fs/bcachefs/btree_iter.c:994 [inline]
 bch2_btree_path_traverse_one+0x1367/0x21d0 fs/bcachefs/btree_iter.c:1202
 bch2_btree_path_traverse fs/bcachefs/btree_iter.h:250 [inline]
 __bch2_btree_iter_peek fs/bcachefs/btree_iter.c:2267 [inline]
 bch2_btree_iter_peek_max+0x9e8/0x58f0 fs/bcachefs/btree_iter.c:2384
 bch2_btree_iter_peek_max_type fs/bcachefs/btree_iter.h:743 [inline]
 bch2_gc_btree fs/bcachefs/btree_gc.c:729 [inline]
 bch2_gc_btrees fs/bcachefs/btree_gc.c:792 [inline]
 bch2_check_allocations+0x120d/0x57b0 fs/bcachefs/btree_gc.c:1094
 bch2_run_recovery_pass fs/bcachefs/recovery_passes.c:484 [inline]
 __bch2_run_recovery_passes+0x3bd/0x1060 fs/bcachefs/recovery_passes.c:539
 bch2_run_recovery_passes+0x184/0x210 fs/bcachefs/recovery_passes.c:610
 bch2_fs_recovery+0x2690/0x3a50 fs/bcachefs/recovery.c:1016
 bch2_fs_start+0xaaf/0xda0 fs/bcachefs/super.c:1213
 bch2_fs_get_tree+0xb39/0x1520 fs/bcachefs/fs.c:2488
 vfs_get_tree+0x8f/0x2b0 fs/super.c:1815
 do_new_mount+0x2a2/0x9e0 fs/namespace.c:3808
 do_mount fs/namespace.c:4136 [inline]
 __do_sys_mount fs/namespace.c:4347 [inline]
 __se_sys_mount+0x317/0x410 fs/namespace.c:4324
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcb57f3038a
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc365dc0a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007ffc365dc130 RCX: 00007fcb57f3038a
RDX: 0000200000000040 RSI: 0000200000004940 RDI: 00007ffc365dc0f0
RBP: 0000200000000040 R08: 00007ffc365dc130 R09: 0000000000004000
R10: 0000000000004000 R11: 0000000000000246 R12: 0000200000004940
R13: 00007ffc365dc0f0 R14: 00000000000049ae R15: 0000200000000180
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:bch2_btree_path_level_init+0xa01/0xa20 fs/bcachefs/btree_iter.c:633
Code: fd 90 0f 0b e8 90 05 a2 fd 90 0f 0b e8 88 05 a2 fd 90 0f 0b e8 80 05 a2 fd 90 0f 0b e8 78 05 a2 fd 90 0f 0b e8 70 05 a2 fd 90 <0f> 0b e8 68 05 a2 fd 90 0f 0b e8 60 05 a2 fd 90 0f 0b 66 66 66 66
RSP: 0018:ffffc90003f8e4a0 EFLAGS: 00010293
RAX: ffffffff841c59a0 RBX: ffff88803d33c2d8 RCX: ffff888030d73b80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed1007c6c817 R12: 0000000000000052
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  000055557a974500(0000) GS:ffff8881268c1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff395c5f24 CR3: 0000000027dc0000 CR4: 00000000003526f0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-11-14 12:17 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-05 16:05 [PATCH] bcachefs:fix use-after-free in __bch2_bkey_fsck_err ssrane_b23
     [not found] ` <CANNWa05YhQ9Ycr13e3SOYgD=cms5iskSENUwXUgk0T8zkMy97Q@mail.gmail.com>
2025-10-05 16:48   ` [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (4) syzbot
2025-10-05 18:05   ` [PATCH] bcachefs:fix use-after-free in __bch2_bkey_fsck_err Kent Overstreet
     [not found]     ` <CANNWa04Mei+hLsZ5JkCfejgiByJgu8e1Euy--ypT_ZmWuvvHeQ@mail.gmail.com>
2025-10-15  8:20       ` SHAURYA RANE
  -- strict thread matches above, loose matches on Subject: below --
2025-09-05 12:19 [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (4) syzbot
2025-09-05 16:39 ` syzbot
2025-11-14 12:17 ` syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox