2.6.37.3 crashes when btrfs is used for root partition

[spender]

I've reproduced the BUG() here, so I'll let you know when I have a fix.

-Brad

[am7op5]

Thanks. Just to answer your previous question: the earliest kernel I tried was hardened-sources-2.6.37-r6 on Gentoo, which is vanilla 2.6.37.3 + genpatches-2.6.37.4 + grsecurity-2.2.1-2.6.37.3-201103122250. I just installed grsec a couple days ago so I haven't tried anything older than that.

[spender]

Ok guys, thanks for being patient. If you can try the patch at http://grsecurity.net/~spender/grsec-2. ... est2.patch
I've tested it here to confirm it fixes the btrfs issue, and the way I fixed it should support any other btrfs features like subvolumes. Let me know if you have any problems with it.

Thanks again,
-Brad

[am7op5]

I can confirm that it works for me. Thanks!

[spender]

There's still one thing I have to fix with that patch related to policy recreation. I'll have a fixed version up tonight.

-Brad

[spender]

New patch up at http://grsecurity.net/~spender/grsec-2. ... est3.patch that fixes it up completely.

-Brad

[nannou9]

Grsec now is working as it should with BTRFS I have tested with official test patch.
Thank you very much Spender for your great job!

[YuHg]

I seem to have the same problem with the latest testing patch (grsecurity-2.9.1-3.6.2-201210151829.patch)
Panic at gracl.c:1921 when I try to enable gradm. My root fs is a btrfs partition... a btrfs subvolume actually. That may be causing the problem ?..

[spender]

I've not tested yet with btrfs subvolumes, though I don't see immediately why it wouldn't work. You could help debug it by pasting the results of:

Code: Select all

stat /

and adding:

Code: Select all

if (retval == NULL)
   printk(KERN_ALERT "bad root inode=%lu, dev=%d\n", dentry->d_inode->i_ino, __get_dev(dentry));


just above the BUG_ON(retval == NULL); in grsecurity/gracl.c

-Brad

[YuHg]

Code: Select all

# stat /
  File: '/'
  Size: 152          Blocks: 0          IO Block: 4096   directory
Device: 12h/18d   Inode: 256         Links: 1
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)

Code: Select all

$ btrfs subvolume list -t -p -a /
ID   gen   parent   top level   path   
--   ---   ------   ---------   ----   
256   36566   5   5      <FS_TREE>/root
# mount /dev/mapper/root /mnt  ### mounting the btrfs partition at the root
# stat /mnt/root   ### stat'ing the subvolume (which is mounted as /) again
  File: '/mnt/root'
  Size: 152          Blocks: 0          IO Block: 4096   directory
Device: 12h/18d   Inode: 256         Links: 1
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
[root@Laptop ~]# stat /mnt/    ### stat'ing the real root of the partition
  File: '/mnt/'
  Size: 8            Blocks: 8          IO Block: 4096   directory
Device: 11h/17d   Inode: 256         Links: 1
Access: (0555/dr-xr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)


Code: Select all

[   79.979478] bad root inode=256, dev=16
[   79.980506] ------------[ cut here ]------------
[   79.981507] kernel BUG at grsecurity/gracl.c:1923!
[   79.982502] invalid opcode: 0000 [#1] PREEMPT SMP
(...)
[   80.005235] Process gradm (pid: 1459, threadinfo ffff88021389da38, task ffff88021389d500)
[   80.006400] Stack:
[   80.007559]  ffff880200000001 ffffffff8128c9c1 ffff880212602e9c ffffffff00000010
[   80.008764]  0000000000000000 ffff880213230200 ffff88020e9e0c00 ffff880213230220
[   80.009972]  0000000101230220 ffff880213230220 0000000000000001 0000000000000000
[   80.011183] Call Trace:
[   80.012377]  [<ffffffff8128c9c1>] ? gen_full_path+0x151/0x1b0
[   80.013584]  [<ffffffff812904e1>] gr_apply_subject_to_task+0xc1/0x190
[   80.014796]  [<ffffffff81290ac2>] gr_set_acls+0xf2/0x1c0
[   80.016004]  [<ffffffff81290f49>] ? gracl_init+0x3b9/0x1140
[   80.017213]  [<ffffffff81290f90>] gracl_init+0x400/0x1140
[   80.018418]  [<ffffffff812926bb>] write_grsec_handler+0x9eb/0xe10
[   80.019628]  [<ffffffff8118f65b>] vfs_write+0xdb/0x200
[   80.020835]  [<ffffffff8118fa7e>] sys_write+0x4e/0xa0
[   80.022045]  [<ffffffff8150e9e9>] system_call_fastpath+0x1c/0x21
[   80.023265]  [<ffffffff8150ea17>] ? sysret_check+0x24/0x5f
[   80.024484] Code: 78 48 00 0f 85 0f fd ff ff e9 f4 fe ff ff 49 8b 47 30 48 c7 c7 d2 cf 6a 81 48 8b 50 28 48 8b 70 40 31 c0 8b 52 10 e8 3e f2 26 00 <0f> 0b 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 20 48 89 5d
[   80.027373] RIP  [<ffffffff8128d4f6>] __chk_obj_label+0x366/0x370
[   80.028724]  RSP <ffff880211b65b78>
[   80.030076] ---[ end trace 9d634a244c3fffc1 ]---


[YuHg]

Up.
I think I found the problem. I was compiling BTRFS as a module, so in gracl.c the code inside #ifdef CONFIG_BTRFS_FS was not compiled.
When BTRFS is compiled as a module, the CONFIG_BTRFS_FS_MODULE constant is set instead of CONFIG_BTRFS_FS..

When I compiled BTRFS inside the kernel (=y), everything worked fine.

[spender]

This will be fixed in the next patches, thanks for spotting this!

-Brad