btrfs subvolume list segmentation fault

[Marcel]

Under Ubuntu 18.04 LTS with HWE-Kernel 5.4.0-52-generic the command

btrfs subvolume list /

sometimes leads to a segmentation fault. Unfortunately I cannot figure out why some calls of this command work as expected while others (of exactly the same command) lead to the segmentation fault. On my machine about every third call leads to the segfault.

In case of the segmentation fault, my syslog contains the following entries:
Nov 2 13:56:11 Sputnik kernel: [153948.460139] btrfs[19583]: segfault at 7ffcd9d8c391 ip 000055d8e5201117 sp 00007ffcd5d8bd20 error 4 in btrfs[55d8e5195000+a9000]
Nov 2 13:56:11 Sputnik kernel: [153948.460153] Code: 00 00 31 c0 8b 5c 24 14 39 9c 24 88 00 00 00 0f 86 f2 01 00 00 48 8b 7c 24 08 48 8d 57 68 48 8d 0c 02 48 83 c0 20 48 89 04 24 <8b> 71 18 8b 79 1c 48 8b 59 08 48 8b 69 10 81 fe 90 00 00 00 89 74

According to
https://forums.linuxmint.com/viewtopic.php?t=333594
I do not seem to be the only one experiencing this problem.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Andreas Schildbach (schildbach)]

I'm seeing this on fully-updated Ubuntu 20.04 LTS with stock kernel 5.4.0-52-generic.

[David A. Sjøen (dabide)]

We are randomly getting the same segfault on two different servers, one with 18.04 and one with 20.04. Here is the strace output, if it helps:

xxx@yyy:~$ sudo strace btrfs subvolume list /mnt/btrfs
execve("/bin/btrfs", ["btrfs", "subvolume", "list", "/mnt/btrfs"], 0x7ffcd5a42ff8 /* 23 vars */) = 0
brk(NULL) = 0x5576268f3000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=26618, ...}) = 0
mmap(NULL, 26618, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f1d50e75000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libuuid.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@\26\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=27112, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1d50e73000
mmap(NULL, 2122112, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1d50a4e000
mprotect(0x7f1d50a54000, 2093056, PROT_NONE) = 0
mmap(0x7f1d50c53000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f1d50c53000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libblkid.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000\230\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=311720, ...}) = 0
mmap(NULL, 2411776, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1d50801000
mprotect(0x7f1d50848000, 2097152, PROT_NONE) = 0
mmap(0x7f1d50a48000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x47000) = 0x7f1d50a48000
mmap(0x7f1d50a4d000, 3328, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1d50a4d000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\37\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=116960, ...}) = 0
mmap(NULL, 2212016, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1d505e4000
mprotect(0x7f1d50600000, 2093056, PROT_NONE) = 0
mmap(0x7f1d507ff000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b000) = 0x7f1d507ff000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/liblzo2.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000#\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=137256, ...}) = 0
mmap(NULL, 2232416, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1d503c2000
mprotect(0x7f1d503e3000, 2093056, PROT_NONE)...