[trusty] btrfs: reboot/crash when running xfs btrfs tests 035

Bug #1413129 reported by Colin Ian King
22
This bug affects 3 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Invalid
Undecided
Unassigned
Trusty
Fix Released
High
Colin Ian King

Bug Description

Running xfs btrfs specific tests 035 with various mount options with 7 target btrfs devices causes the kernel to crash when running inside a virtual machine. Bisecting tracked the fix down to commit 00fdf13a2e9f313a044288aa59d3b8ec29ff904a:

Author: Liu Bo <email address hidden>
Date: Mon Mar 10 18:56:07 2014 +0800

    Btrfs: fix a crash of clone with inline extents's split

    xfstests's btrfs/035 triggers a BUG_ON, which we use to detect the split
    of inline extents in __btrfs_drop_extents().

    For inline extents, we cannot duplicate another EXTENT_DATA item, because
    it breaks the rule of inline extents, that is, 'start offset' needs to be 0.

    We have set limitations for the source inode's compressed inline extents,
    because it needs to decompress and recompress. Now the destination inode's
    inline extents also need similar limitations.

    With this, xfstests btrfs/035 doesn't run into panic.

    Signed-off-by: Liu Bo <email address hidden>
    Signed-off-by: Chris Mason <email address hidden>

SRU Justification:

[Impact]
Running standard btrfs test 035 will cause a machine to reboot.

[Fix]
commit 00fdf13a2e9f313a044288aa59d3b8ec29ff904a
 Btrfs: fix a crash of clone with inline extents's split

[Testcase]
Run xfs "btrfs specific" test 35 with 7 devices for the btrfs scratch pool. Run with all mount options. Without the fix, the machine reboots. With the fix, one can run this multiple times w/o a reboot.

CVE References

Changed in linux (Ubuntu):
importance: Undecided → High
status: New → In Progress
assignee: nobody → Colin Ian King (colin-king)
description: updated
Revision history for this message
Andy Whitcroft (apw) wrote :

This is upstream as of v3.15, therefore utopic and vivid are not affected.

Changed in linux (Ubuntu Trusty):
status: New → In Progress
importance: Undecided → High
assignee: nobody → Colin Ian King (colin-king)
Changed in linux (Ubuntu):
status: In Progress → Invalid
importance: High → Undecided
assignee: Colin Ian King (colin-king) → nobody
Andy Whitcroft (apw)
Changed in linux (Ubuntu Trusty):
status: In Progress → Fix Committed
Revision history for this message
Brad Figg (brad-figg) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-trusty
Revision history for this message
Colin Ian King (colin-king) wrote :

verified with Linux ubuntu 3.13.0-46-generic #75-Ubuntu SMP Tue Feb 10 15:24:04 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux - passed - no crashes.

tags: added: verification-done-trusty
removed: verification-needed-trusty
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (12.8 KiB)

This bug was fixed in the package linux - 3.13.0-46.75

---------------
linux (3.13.0-46.75) trusty; urgency=low

  [ Seth Forshee ]

  * Release Tracking Bug
    - LP: #1419963

  [ Andy Whitcroft ]

  * [Debian] arm64 -- build ubuntu drivers
    - LP: #1411284
  * hyper-v -- fix comment handing in /etc/network/interfaces
    - LP: #1413020

  [ Kamal Mostafa ]

  * [Packaging] force "dpkg-source -I -i" behavior

  [ Upstream Kernel Changes ]

  * Revert "[SCSI] mpt2sas: Remove phys on topology change."
    - LP: #1419838
  * Revert "[SCSI] mpt3sas: Remove phys on topology change"
    - LP: #1419838
  * Btrfs: fix transaction abortion when remounting btrfs from RW to RO
    - LP: #1411320
  * Btrfs: fix a crash of clone with inline extents's split
    - LP: #1413129
  * net/mlx4_en: Add VXLAN ndo calls to the PF net device ops too
    - LP: #1407760
  * KVM: x86: SYSENTER emulation is broken
    - LP: #1414651
    - CVE-2015-0239
  * powerpc/xmon: Fix another endiannes issue in RTAS call from xmon
    - LP: #1415919
  * ipv6: fix swapped ipv4/ipv6 mtu_reduced callbacks
    - LP: #1404558, #1419837
  * usb: gadget: at91_udc: move prepare clk into process context
    - LP: #1419837
  * KVM: x86: Fix far-jump to non-canonical check
    - LP: #1419837
  * x86/tls: Validate TLS entries to protect espfix
    - LP: #1419837
  * userns: Check euid no fsuid when establishing an unprivileged uid
    mapping
    - LP: #1419837
  * userns: Document what the invariant required for safe unprivileged
    mappings.
    - LP: #1419837
  * userns: Only allow the creator of the userns unprivileged mappings
    - LP: #1419837
  * x86_64, switch_to(): Load TLS descriptors before switching DS and ES
    - LP: #1419837
  * isofs: Fix infinite looping over CE entries
    - LP: #1419837
  * batman-adv: Calculate extra tail size based on queued fragments
    - LP: #1419837
  * KEYS: close race between key lookup and freeing
    - LP: #1419837
  * isofs: Fix unchecked printing of ER records
    - LP: #1419837
  * x86_64, vdso: Fix the vdso address randomization algorithm
    - LP: #1419837
  * groups: Consolidate the setgroups permission checks
    - LP: #1419837
  * userns: Don't allow setgroups until a gid mapping has been setablished
    - LP: #1419837
  * userns: Don't allow unprivileged creation of gid mappings
    - LP: #1419837
  * move d_rcu from overlapping d_child to overlapping d_alias
    - LP: #1419837
  * deal with deadlock in d_walk()
    - LP: #1419837
  * Linux 3.13.11-ckt14
    - LP: #1419837
  * gre: fix the inner mac header in nbma tunnel xmit path
    - LP: #1419838
  * netlink: Always copy on mmap TX.
    - LP: #1419838
  * netlink: Don't reorder loads/stores before marking mmap netlink frame
    as available
    - LP: #1419838
  * in6: fix conflict with glibc
    - LP: #1419838
  * tg3: tg3_disable_ints using uninitialized mailbox value to disable
    interrupts
    - LP: #1419838
  * batman-adv: Unify fragment size calculation
    - LP: #1419838
  * batman-adv: avoid NULL dereferences and fix if check
    - LP: #1419838
  * net: Fix stacked vlan offload features computation
    - LP: #1419838
  * net: Reset secmark when scrubbing packet
    - L...

Changed in linux (Ubuntu Trusty):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.