Re: btrfs oops while mounting fuzzed btrfs image

[Eric Sandeen <sandeen@redhat.com>]

On 3/5/15 3:46 AM, Liu Bo wrote:
> On Thu, Mar 05, 2015 at 03:09:33PM +0800, Eryu Guan wrote:
>> Hi,
>>
>> I was testing btrfs with fsfuzzer and encountered a divide error on
>> mount, kernel version 3.19 and 4.0-rc1.
>>
>> I found a similar bug on kernel bugzilla
>>
>> https://bugzilla.kernel.org/show_bug.cgi?id=88611
>>
>> Please find the fuzzed btrfs image in the buzilla, and the following
>> command will reproduce:
>>
>> mount -o loop btrfs.img /mnt/btrfs
> 
> A divide by 0 oops.
> 
> My printk shows that a raid56 chunk has a negative map->length, so we need to find out
> how fsfuzzer made that.  Can you share your script so that we can
> reproduce the oops?

All you need to reproduce the oops is the image Eryu provided.

fsfuzzer intentionally damages the filesystem, simulating what might happen
if hardware goes bad, disks fail, admins dd to the wrong disk, memory corrupts,
bugs happen, etc.

The point is that filesystems need to be robust in the face of unexpected data
on the disk, and Eryu has uncovered a case where btrfs is not.  :)

-Eric