In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: do not force reloc root creation during qgroup_account_snapshot()<\/p>\n
[BUG]
\nWhen running btrfs\/252 with quota enabled through MKFS_OPTIONS=”-O quota”,
\nit has a high chance to trigger the following kernel warning and flips
\nthe fs RO:<\/p>\n
BTRFS info (device dm-2): relocating block group 30408704 flags metadata|dup
\n ————[ cut here ]————
\n WARNING: fs\/btrfs\/extent-tree.c:879 at lookup_inline_extent_backref+0x74b\/0x960 [btrfs], CPU#4: btrfs\/2173
\n CPU: 4 UID: 0 PID: 2173 Comm: btrfs Not tainted 7.2.0-rc6-custom+ #457 PREEMPT(full) 3adc6528fb66f7a55fe1095385818e742f200aab
\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02\/02\/2022
\n RIP: 0010:lookup_inline_extent_backref+0x74b\/0x960 [btrfs]
\n Call Trace:<\/p>\n
insert_inline_extent_backref+0x7c\/0x160 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n __btrfs_inc_extent_ref+0xa9\/0x270 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n __btrfs_run_delayed_refs+0x4af\/0x11c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n btrfs_run_delayed_refs+0x9d\/0xf0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n create_pending_snapshot+0x39d\/0xf00 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n create_pending_snapshots+0x9b\/0xc0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n btrfs_commit_transaction+0x280\/0xeb0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n prepare_to_relocate+0x147\/0x200 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n relocate_block_group+0x6b\/0x5e0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n btrfs_relocate_block_group+0x92c\/0x2380 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n btrfs_relocate_chunk+0x3f\/0x1a0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n btrfs_balance+0xa2c\/0x19c0 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n btrfs_ioctl+0x2839\/0x2d30 [btrfs 32f09462c54d9c922fca74a3e4866f4aa7737b72]
\n __x64_sys_ioctl+0x416\/0x9a0
\n do_syscall_64+0xe1\/0x790
\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53<\/p>\n
—[ end trace 0000000000000000 ]—
\n BTRFS info (device dm-2): leaf 4593991680 gen 233 total ptrs 175 free space 5953 owner 2
\n BTRFS info (device dm-2): refs 3 lock_owner 2173 current 2173
\n \titem 0 key (166772736 METADATA_ITEM 1) itemoff 16250 itemsize 33
\n \t\textent refs 1 gen 222 flags 2
\n \t\tref#0: tree block backref root 266
\n [ Skip the tree dump ]
\n \titem 174 key (263225344 METADATA_ITEM 0) itemoff 10328 itemsize 33
\n \t\textent refs 1 gen 162 flags 258
\n \t\tref#0: tree block backref root 267
\n BTRFS error (device dm-2): extent item not found for insert, bytenr 179847168 num_bytes 16384 parent 4594335744 root_objectid 273 owner 0 offset 0
\n BTRFS error (device dm-2): failed to run delayed ref for logical 179847168 num_bytes 16384 type 182 action 1 ref_mod 1: -117<\/p>\n
[CAUSE]
\nThe above error is showing that there is a tree reference to a metadata
\nextent that is no longer there.<\/p>\n
With “ref_verify” mount option (requires CONFIG_BTRFS_DEBUG), there is
\nsome extra debug output:<\/p>\n
BTRFS error (device dm-2): dumping block entry [180961280 16384], num_refs 0, metadata 1, from disk 0
\n BTRFS error (device dm-2): root entry 256, num_refs 18446744073709551615
\n BTRFS error (device dm-2): root entry 273, num_refs 18446744073709551615
\n BTRFS error (device dm-2): Ref action 3, root 273, ref_root 273, parent 0, owner 0, offset 0, num_refs 1
\n btrfs_force_cow_block+0x129\/0x7d0 [btrfs]
\n btrfs_cow_block+0x10a\/0x250 [btrfs]
\n btrfs_search_slot+0x5eb\/0xf40 [btrfs]
\n btrfs_insert_empty_items+0x3a\/0x70 [btrfs]
\n insert_with_overflow+0x53\/0x130 [btrfs]
\n btrfs_insert_dir_item+0x125\/0x290 [btrfs]
\n btrfs_add_link+0xaa\/0x410 [btrfs]
\n btrfs_rename+0x5ea\/0xcd0 [btrfs]
\n btrfs_rename2+0x28\/0x60 [btrfs]
\n vfs_rename+0x5b2\/0xe10
\n filename_renameat2+0x244\/0x430
\n __x64_sys_rename+0x48\/0x70
\n do_syscall_64+0xe1\/0x790
\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53<\/p>\n
—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: do not force reloc root creation during qgroup_account_snapshot()<\/p>\n
[BUG]
\nWhen running btrfs\/252 with quota enabled through M<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29235","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29235","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29235"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29235"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29235"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}