Hello. We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.7. Attached to the email were a PoC file of the issue. Stack dump: snapshot points to missing/incorrect tree: u64s 8 type snapshot 0:4294967295:0 len 0 ver 0: is_subvol 1 deleted 0 parent 0 children 0 0 subvol 1 tree 0, fixing ============================= WARNING: suspicious RCU usage 6.7.0 #2 Not tainted ----------------------------- fs/bcachefs/snapshot.h:41 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 5 locks held by syz-executor.2/71285: #0: ffff888073700268 (&c->state_lock){+.+.}-{3:3}, at: bch2_fs_start+0x97/0x5e0 fs/bcachefs/super.c:956 #1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:116 [inline] #1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:215 [inline] #1: ffff8880737040e8 (&c->btree_trans_barrier){.+.+}-{0:0}, at: __bch2_trans_get+0x594/0x950 fs/bcachefs/btree_iter.c:3020 #2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline] #2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline] #2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline] #2: ffff88801f303070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146 #3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline] #3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline] #3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline] #3: ffff88801f307070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146 #4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: six_trylock_type fs/bcachefs/six.h:214 [inline] #4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: btree_node_lock fs/bcachefs/btree_locking.h:268 [inline] #4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: btree_path_lock_root fs/bcachefs/btree_iter.c:747 [inline] #4: ffff88801177e070 (&dev->mutex){....}-{3:3}, at: bch2_btree_path_traverse_one+0xd51/0x2450 fs/bcachefs/btree_iter.c:1146 stack backtrace: CPU: 1 PID: 71285 Comm: syz-executor.2 Not tainted 6.7.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106 lockdep_rcu_suspicious+0x207/0x3b0 kernel/locking/lockdep.c:6712 snapshot_t fs/bcachefs/snapshot.h:41 [inline] bch2_snapshot_tree_oldest_subvol+0x919/0xc40 fs/bcachefs/snapshot.c:445 snapshot_tree_ptr_repair+0x642/0x1e40 fs/bcachefs/snapshot.c:685 check_snapshot+0x1737/0x2640 fs/bcachefs/snapshot.c:808 bch2_check_snapshots+0x2da/0x5c0 fs/bcachefs/snapshot.c:867 bch2_run_recovery_pass fs/bcachefs/recovery.c:655 [inline] bch2_run_recovery_passes+0x2ba/0x510 fs/bcachefs/recovery.c:672 bch2_fs_recovery+0x36fe/0x52d0 fs/bcachefs/recovery.c:918 bch2_fs_start+0x365/0x5e0 fs/bcachefs/super.c:978 bch2_fs_open+0x1ac9/0x3890 fs/bcachefs/super.c:1968 bch2_mount+0x538/0x13c0 fs/bcachefs/fs.c:1863 legacy_get_tree+0x109/0x220 fs/fs_context.c:662 vfs_get_tree+0x93/0x380 fs/super.c:1771 do_new_mount fs/namespace.c:3337 [inline] path_mount+0x679/0x1e40 fs/namespace.c:3664 do_mount fs/namespace.c:3677 [inline] __do_sys_mount fs/namespace.c:3886 [inline] __se_sys_mount fs/namespace.c:3863 [inline] __x64_sys_mount+0x287/0x310 fs/namespace.c:3863 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x43/0x120 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7fe38c291b3e Code: 48 c7 c0 ff ff ff ff eb aa e8 be 0d 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe38cf6ee38 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00000000000119fc RCX: 00007fe38c291b3e RDX: 0000000020011a00 RSI: 0000000020000040 RDI: 00007fe38cf6ee90 RBP: 00007fe38cf6eed0 R08: 00007fe38cf6eed0 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000202 R12: 0000000020011a00 R13: 0000000020000040 R14: 00007fe38cf6ee90 R15: 0000000020000100 done bcachefs (loop2): check_subvols... done bcachefs (loop2): delete_dead_snapshots... done bcachefs (loop2): resume_logged_ops... done bcachefs (loop2): check_inodes... done bcachefs (loop2): check_extents... done bcachefs (loop2): check_indirect_extents... done bcachefs (loop2): check_dirents... done bcachefs (loop2): check_xattrs... done bcachefs (loop2): check_root... done bcachefs (loop2): check_directory_structure... done bcachefs (loop2): check_nlinks... done bcachefs (loop2): delete_dead_inodes... done bcachefs (loop2): set_fs_needs_rebalance... done bcachefs (loop2): Fixed errors, running fsck a second time to verify fs is clean bcachefs (loop2): check_alloc_info... done bcachefs (loop2): check_lrus... done bcachefs (loop2): check_btree_backpointers... done bcachefs (loop2): check_backpointers_to_extents... done bcachefs (loop2): check_extents_to_backpointers... done bcachefs (loop2): check_alloc_to_lru_refs... done bcachefs (loop2): bucket_gens_init... done bcachefs (loop2): check_snapshot_trees... done bcachefs (loop2): check_snapshots... done bcachefs (loop2): check_subvols... done bcachefs (loop2): delete_dead_snapshots... done bcachefs (loop2): resume_logged_ops... done bcachefs (loop2): check_inodes... done bcachefs (loop2): check_extents... done bcachefs (loop2): check_indirect_extents... done bcachefs (loop2): check_dirents... done bcachefs (loop2): check_xattrs... done bcachefs (loop2): check_root... done bcachefs (loop2): check_directory_structure... done bcachefs (loop2): check_nlinks... done bcachefs (loop2): delete_dead_inodes... done bcachefs (loop2): set_fs_needs_rebalance... done bcachefs (loop2): flushing journal and stopping allocators, journal seq 11 bcachefs (loop2): flushing journal and stopping allocators complete, journal seq 11 bcachefs (loop2): marking filesystem clean Thank you for taking the time to read this email and we look forward to working with you further.