* [PATCH] btrfs: do not trim a device which is not writeable
@ 2026-06-02 4:04 Qu Wenruo
2026-06-02 5:38 ` Su Yue
2026-06-02 10:11 ` Filipe Manana
0 siblings, 2 replies; 3+ messages in thread
From: Qu Wenruo @ 2026-06-02 4:04 UTC (permalink / raw)
To: linux-btrfs; +Cc: Su Yue, stable
[BUG]
There is a bug report that btrfs/242 can randomly fail with the
following NULL pointer dereference:
run fstests btrfs/242 at 2026-06-01 10:25:08
BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)
BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874
BTRFS info (device sdc): using crc32c checksum algorithm
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS info (device sdc): allowing degraded mounts
BTRFS info (device sdc): turning on async discard
BTRFS info (device sdc): enabling free space tree
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025
pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
Call trace:
btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)
btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
__arm64_sys_ioctl+0xac/0x108
invoke_syscall.constprop.0+0x5c/0xd0
el0_svc_common.constprop.0+0x40/0xf0
do_el0_svc+0x24/0x40
el0_svc+0x40/0x1d0
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
---[ end trace 0000000000000000 ]---
Also the reporter is very kind to test the following ASSERT() added to
btrfs_trim_free_extents_throttle():
ASSERT(device->bdev,
"devid=%llu path=%s dev_state=0x%lx\n",
device->devid, btrfs_dev_name(device), device->dev_state);
And it shows the following output:
assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)
Which means the device->bdev is NULL, and the dev_state is
BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without
BTRFS_DEV_STATE_WRITEABLE flag set.
[CAUSE]
The pc points to the following call chain:
btrfs_trim_fs()
|- btrfs_trim_free_extents()
|- btrfs_trim_free_extents_throttle()
|- bdev_max_discard_sectors(device->bdev)
So the NULL pointer dereference is caused by device->bdev being NULL.
This looks impossible by a quick glance, as just before calling
btrfs_trim_free_extents_throttle(), we have skipped any device that has
BTRFS_DEV_STATE_MISSING flag set.
However in this particular case, there is a window where the missing
device is later re-scanned, causing btrfs to remove the
BTRFS_DEV_STATE_MISSING flag:
btrfs_control_ioctl()
|- btrfs_scan_one_device()
|- device_list_add()
|- rcu_assign_pointer(device->name, name);
| This updates the missing device's path to the new good path.
|
|- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
This removes the BTRFS_DEV_STATE_MISSING flag.
This allows the missing device to re-appear and clear the
BTRFS_DEV_STATE_MISSING flag.
However the device still does not have the BTRFS_DEV_STATE_WRITEABLE
flag set, nor is its bdev pointer updated.
The bdev pointer remains NULL, triggering the crash later.
[FIX]
This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and
device->bdev pointer, and shows a gap in btrfs's re-appearing-device
handling.
The proper handling of re-appearing device will need quite some extra
work, which is out of the context of this small fix.
Thankfully the regular bbio submission path has already handled it well
by checking if the device->bdev is NULL before submitting.
So here we just fix the crash by checking if the device is writeable and
has a bdev pointer before calling bdev_max_discard_sectors().
Reported-by: Su Yue <glass.su@suse.com>
Link: https://lore.kernel.org/linux-btrfs/wlwir19t.fsf@damenly.org/
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: Qu Wenruo <wqu@suse.com>
---
fs/btrfs/extent-tree.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 6030cdbdb742..f3c3eb508f86 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -6624,12 +6624,17 @@ static int btrfs_trim_free_extents_throttle(struct btrfs_device *device,
*trimmed = 0;
- /* Discard not supported = nothing to do. */
- if (!bdev_max_discard_sectors(device->bdev))
+ /*
+ * The caller only filters out MISSING devices, but a device that was
+ * missing at mount and later rescanned has MISSING cleared while
+ * bdev is still NULL and WRITEABLE is still unset. Skip those here.
+ */
+ if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state) ||
+ !device->bdev)
return 0;
- /* Not writable = nothing to do. */
- if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
+ /* Discard not supported = nothing to do. */
+ if (!bdev_max_discard_sectors(device->bdev))
return 0;
/* No free space = nothing to do. */
--
2.54.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] btrfs: do not trim a device which is not writeable
2026-06-02 4:04 [PATCH] btrfs: do not trim a device which is not writeable Qu Wenruo
@ 2026-06-02 5:38 ` Su Yue
2026-06-02 10:11 ` Filipe Manana
1 sibling, 0 replies; 3+ messages in thread
From: Su Yue @ 2026-06-02 5:38 UTC (permalink / raw)
To: Qu Wenruo; +Cc: linux-btrfs, Su Yue, stable
On Tue 02 Jun 2026 at 13:34, Qu Wenruo <wqu@suse.com> wrote:
> [BUG]
> There is a bug report that btrfs/242 can randomly fail with the
> following NULL pointer dereference:
>
> run fstests btrfs/242 at 2026-06-01 10:25:08
> BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1
> transid 9 /dev/sdc (8:32) scanned by mount (122609)
> BTRFS info (device sdc): first mount of filesystem
> d4d7f234-487c-4787-88e4-47a8b68c9874
> BTRFS info (device sdc): using crc32c checksum algorithm
> BTRFS warning (device sdc): devid 2 uuid
> fbe72d72-3272-482d-80fb-ab88ed398192 is missing
> BTRFS warning (device sdc): devid 2 uuid
> fbe72d72-3272-482d-80fb-ab88ed398192 is missing
> BTRFS info (device sdc): allowing degraded mounts
> BTRFS info (device sdc): turning on async discard
> BTRFS info (device sdc): enabling free space tree
> Unable to handle kernel NULL pointer dereference at virtual
> address 0000000000000018
> user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
> CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted
> 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed
> e9a5f6b24978fba3bf015a992f865837fdfff3dd
> Hardware name: QEMU KVM Virtual Machine, BIOS
> edk2-20250812-19.fc42 08/12/2025
> pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
> pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
> lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
> Call trace:
> btrfs_trim_fs+0x34c/0xa00 [btrfs
> f02c1d570ceea621c69d302ba75dd61868083840] (P)
> btrfs_ioctl_fitrim+0xe8/0x178 [btrfs
> f02c1d570ceea621c69d302ba75dd61868083840]
> btrfs_ioctl+0xdd4/0x2bd8 [btrfs
> f02c1d570ceea621c69d302ba75dd61868083840]
> __arm64_sys_ioctl+0xac/0x108
> invoke_syscall.constprop.0+0x5c/0xd0
> el0_svc_common.constprop.0+0x40/0xf0
> do_el0_svc+0x24/0x40
> el0_svc+0x40/0x1d0
> el0t_64_sync_handler+0xa0/0xe8
> el0t_64_sync+0x1b0/0x1b8
> Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
> ---[ end trace 0000000000000000 ]---
>
> Also the reporter is very kind to test the following ASSERT()
> added to
> btrfs_trim_free_extents_throttle():
>
> ASSERT(device->bdev,
> "devid=%llu path=%s dev_state=0x%lx\n",
> device->devid, btrfs_dev_name(device),
> device->dev_state);
>
> And it shows the following output:
>
> assertion failed: device->bdev, in extent-tree.c:6630 (devid=2
> path=/dev/sdd dev_state=0x82)
>
> Which means the device->bdev is NULL, and the dev_state is
> BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND,
> without
> BTRFS_DEV_STATE_WRITEABLE flag set.
>
> [CAUSE]
> The pc points to the following call chain:
>
> btrfs_trim_fs()
> |- btrfs_trim_free_extents()
> |- btrfs_trim_free_extents_throttle()
> |- bdev_max_discard_sectors(device->bdev)
>
> So the NULL pointer dereference is caused by device->bdev being
> NULL.
>
> This looks impossible by a quick glance, as just before calling
> btrfs_trim_free_extents_throttle(), we have skipped any device
> that has
> BTRFS_DEV_STATE_MISSING flag set.
>
> However in this particular case, there is a window where the
> missing
> device is later re-scanned, causing btrfs to remove the
> BTRFS_DEV_STATE_MISSING flag:
>
> btrfs_control_ioctl()
> |- btrfs_scan_one_device()
> |- device_list_add()
> |- rcu_assign_pointer(device->name, name);
> | This updates the missing device's path to the new good
> path.
> |
> |- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
> This removes the BTRFS_DEV_STATE_MISSING flag.
>
> This allows the missing device to re-appear and clear the
> BTRFS_DEV_STATE_MISSING flag.
> However the device still does not have the
> BTRFS_DEV_STATE_WRITEABLE
> flag set, nor is its bdev pointer updated.
>
> The bdev pointer remains NULL, triggering the crash later.
>
> [FIX]
> This is a big de-synchronization between BTRFS_DEV_STATE_MISSING
> and
> device->bdev pointer, and shows a gap in btrfs's
> re-appearing-device
> handling.
>
> The proper handling of re-appearing device will need quite some
> extra
> work, which is out of the context of this small fix.
>
> Thankfully the regular bbio submission path has already handled
> it well
> by checking if the device->bdev is NULL before submitting.
>
> So here we just fix the crash by checking if the device is
> writeable and
> has a bdev pointer before calling bdev_max_discard_sectors().
>
> Reported-by: Su Yue <glass.su@suse.com>
> Link:
> https://lore.kernel.org/linux-btrfs/wlwir19t.fsf@damenly.org/
> Cc: stable@vger.kernel.org # 5.10+
> Signed-off-by: Qu Wenruo <wqu@suse.com>
>
Thanks. No crash happens on my side after applying this patch.
--
Su
> ---
> fs/btrfs/extent-tree.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> index 6030cdbdb742..f3c3eb508f86 100644
> --- a/fs/btrfs/extent-tree.c
> +++ b/fs/btrfs/extent-tree.c
> @@ -6624,12 +6624,17 @@ static int
> btrfs_trim_free_extents_throttle(struct btrfs_device *device,
>
> *trimmed = 0;
>
> - /* Discard not supported = nothing to do. */
> - if (!bdev_max_discard_sectors(device->bdev))
> + /*
> + * The caller only filters out MISSING devices, but a device
> that was
> + * missing at mount and later rescanned has MISSING cleared
> while
> + * bdev is still NULL and WRITEABLE is still unset. Skip those
> here.
> + */
> + if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state)
> ||
> + !device->bdev)
> return 0;
>
> - /* Not writable = nothing to do. */
> - if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
> + /* Discard not supported = nothing to do. */
> + if (!bdev_max_discard_sectors(device->bdev))
> return 0;
>
> /* No free space = nothing to do. */
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] btrfs: do not trim a device which is not writeable
2026-06-02 4:04 [PATCH] btrfs: do not trim a device which is not writeable Qu Wenruo
2026-06-02 5:38 ` Su Yue
@ 2026-06-02 10:11 ` Filipe Manana
1 sibling, 0 replies; 3+ messages in thread
From: Filipe Manana @ 2026-06-02 10:11 UTC (permalink / raw)
To: Qu Wenruo; +Cc: linux-btrfs, Su Yue, stable
On Tue, Jun 2, 2026 at 5:05 AM Qu Wenruo <wqu@suse.com> wrote:
>
> [BUG]
> There is a bug report that btrfs/242 can randomly fail with the
> following NULL pointer dereference:
>
> run fstests btrfs/242 at 2026-06-01 10:25:08
> BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)
> BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874
> BTRFS info (device sdc): using crc32c checksum algorithm
> BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
> BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
> BTRFS info (device sdc): allowing degraded mounts
> BTRFS info (device sdc): turning on async discard
> BTRFS info (device sdc): enabling free space tree
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
> user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
> CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd
> Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025
> pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
> pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
> lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
> Call trace:
> btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)
> btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
> btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
> __arm64_sys_ioctl+0xac/0x108
> invoke_syscall.constprop.0+0x5c/0xd0
> el0_svc_common.constprop.0+0x40/0xf0
> do_el0_svc+0x24/0x40
> el0_svc+0x40/0x1d0
> el0t_64_sync_handler+0xa0/0xe8
> el0t_64_sync+0x1b0/0x1b8
> Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
> ---[ end trace 0000000000000000 ]---
>
> Also the reporter is very kind to test the following ASSERT() added to
> btrfs_trim_free_extents_throttle():
>
> ASSERT(device->bdev,
> "devid=%llu path=%s dev_state=0x%lx\n",
> device->devid, btrfs_dev_name(device), device->dev_state);
>
> And it shows the following output:
>
> assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)
>
> Which means the device->bdev is NULL, and the dev_state is
> BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without
> BTRFS_DEV_STATE_WRITEABLE flag set.
>
> [CAUSE]
> The pc points to the following call chain:
>
> btrfs_trim_fs()
> |- btrfs_trim_free_extents()
> |- btrfs_trim_free_extents_throttle()
> |- bdev_max_discard_sectors(device->bdev)
>
> So the NULL pointer dereference is caused by device->bdev being NULL.
>
> This looks impossible by a quick glance, as just before calling
> btrfs_trim_free_extents_throttle(), we have skipped any device that has
> BTRFS_DEV_STATE_MISSING flag set.
>
> However in this particular case, there is a window where the missing
> device is later re-scanned, causing btrfs to remove the
> BTRFS_DEV_STATE_MISSING flag:
>
> btrfs_control_ioctl()
> |- btrfs_scan_one_device()
> |- device_list_add()
> |- rcu_assign_pointer(device->name, name);
> | This updates the missing device's path to the new good path.
> |
> |- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
> This removes the BTRFS_DEV_STATE_MISSING flag.
>
> This allows the missing device to re-appear and clear the
> BTRFS_DEV_STATE_MISSING flag.
> However the device still does not have the BTRFS_DEV_STATE_WRITEABLE
> flag set, nor is its bdev pointer updated.
>
> The bdev pointer remains NULL, triggering the crash later.
>
> [FIX]
> This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and
> device->bdev pointer, and shows a gap in btrfs's re-appearing-device
> handling.
>
> The proper handling of re-appearing device will need quite some extra
> work, which is out of the context of this small fix.
>
> Thankfully the regular bbio submission path has already handled it well
> by checking if the device->bdev is NULL before submitting.
>
> So here we just fix the crash by checking if the device is writeable and
> has a bdev pointer before calling bdev_max_discard_sectors().
>
> Reported-by: Su Yue <glass.su@suse.com>
> Link: https://lore.kernel.org/linux-btrfs/wlwir19t.fsf@damenly.org/
> Cc: stable@vger.kernel.org # 5.10+
Fixes: 499f377f49f0 ("btrfs: iterate over unused chunk space in FITRIM")
Please always try to include the offending commit to make downstream
work easier.
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Thanks.
> Signed-off-by: Qu Wenruo <wqu@suse.com>
> ---
> fs/btrfs/extent-tree.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
> index 6030cdbdb742..f3c3eb508f86 100644
> --- a/fs/btrfs/extent-tree.c
> +++ b/fs/btrfs/extent-tree.c
> @@ -6624,12 +6624,17 @@ static int btrfs_trim_free_extents_throttle(struct btrfs_device *device,
>
> *trimmed = 0;
>
> - /* Discard not supported = nothing to do. */
> - if (!bdev_max_discard_sectors(device->bdev))
> + /*
> + * The caller only filters out MISSING devices, but a device that was
> + * missing at mount and later rescanned has MISSING cleared while
> + * bdev is still NULL and WRITEABLE is still unset. Skip those here.
> + */
> + if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state) ||
> + !device->bdev)
> return 0;
>
> - /* Not writable = nothing to do. */
> - if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
> + /* Discard not supported = nothing to do. */
> + if (!bdev_max_discard_sectors(device->bdev))
> return 0;
>
> /* No free space = nothing to do. */
> --
> 2.54.0
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-02 10:12 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-02 4:04 [PATCH] btrfs: do not trim a device which is not writeable Qu Wenruo
2026-06-02 5:38 ` Su Yue
2026-06-02 10:11 ` Filipe Manana
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox