PAX: size overflow detected in function btrfs_sync_file

Discuss usability issues, general maintenance, and general support issues for a grsecurity-enabled system.

PAX: size overflow detected in function btrfs_sync_file

Postby bellsyaorin » Sat Oct 24, 2015 6:55 pm

Linux hostname 4.2.4.201510222059-1-grsec #1 SMP PREEMPT Thu Oct 22 23:14:46 EDT 2015 x86_64 GNU/Linux

in vmware
Code: Select all
PAX: size overflow detected in function try_merge_map fs/btrfs/extent_map.c:238 cicus.101_102 max, count: 13
CPU: 0 PID: 246 Comm: login Not tainted 4.2.4.201510222059-1-grsec #1
Hardware name: VMware, Inc. VMware7,1/440BX Desktop Reference Platform, BIOS VMW71.00V.0.B64.1507021939 07/0
 ffffffff84a0a847 52c0beb73ef9e8ec 0000000000000000 ffffffffc032c45d
 ffffc90000ad35a8 ffffffff845d5bd8 000000000000009b ffffffffc032c473
 ffffc90000ad35d8 ffffffff841a88ca ffff88000d9abdb0 ffff88000d86f1d0
Call Trace:
 [<ffffffffc032c45d>] ? exit_btrfs_fs+0x1cd51/0x344d4 [btrfs]
 [<ffffffff845d5bd8>] dump_stack+0x4c/0x7f
 [<ffffffffc032c473>] ? exit_btrfs_fs+0x1cd67/0x344d4 [btrfs]
 [<ffffffff841a88ca>] report_size_overflow+0x5a/0x60
 [<ffffffffc029e567>] try_merge_map+0x207/0x320 [btrfs]
 [<ffffffffc029e8bf>] add_extent_mapping+0x11f/0x1a0 [btrfs]
 [<ffffffffc0285189>] btrfs_get_extent+0x619/0xdd0 [btrfs]
 [<ffffffffc02a4f8e>] ? insert_state+0x9e/0x120 [btrfs]
 [<ffffffffc02a9f60>] __do_readpage+0x280/0xd20 [btrfs]
 [<ffffffffc02a6781>] ? lock_extent_bits+0x91/0x220 [btrfs]
 [<ffffffffc0284b70>] ? btrfs_direct_IO+0x3a0/0x3a0 [btrfs]
 [<ffffffffc02aaefc>] __extent_readpages.constprop.25+0x2dc/0x320 [btrfs]
 [<ffffffff8411de7a>] ? __add_to_page_cache_locked+0x1ea/0x250
 [<ffffffffc0284b70>] ? btrfs_direct_IO+0x3a0/0x3a0 [btrfs]
 [<ffffffffc02ab8f4>] extent_readpages+0x1e4/0x1f0 [btrfs]
 [<ffffffffc0284b70>] ? btrfs_direct_IO+0x3a0/0x3a0 [btrfs]
 [<ffffffff8417460d>] ? alloc_pages_current+0x8d/0x100
 [<ffffffffc0282d55>] btrfs_readpages+0x35/0x50 [btrfs]
 [<ffffffff8412dd5b>] __do_page_cache_readahead+0x1fb/0x290
 [<ffffffff8412ded9>] ondemand_readahead+0xe9/0x2f0
 [<ffffffff8412e23a>] page_cache_sync_readahead+0x4a/0x80
 [<ffffffff841207e8>] generic_file_read_iter+0x5e8/0x7a0
 [<ffffffff8419eb36>] __vfs_read+0x106/0x130
 [<ffffffff8419f746>] vfs_read+0xd6/0x250
 [<ffffffff841a0a09>] SyS_read+0x59/0xd0
 [<ffffffff845dbdf0>] entry_SYSCALL_64_fastpath+0x12/0x8a
PAX: size overflow detected in function btrfs_sync_file fs/btrfs/file.c:1871 cicus.676_106 max, count: 295,
CPU: 0 PID: 169 Comm: systemd-journal Not tainted 4.2.4.201510222059-1-grsec #1
Hardware name: VMware, Inc. VMware7,1/440BX Desktop Reference Platform, BIOS VMW71.00V.0.B64.1507021939 07/0
 ffffffff84a0a847 5d7d83f7565e52a8 0000000000000000 ffffffffc032c346
 ffffc90000a13ce8 ffffffff845d5bd8 00000000000000a4 ffffffffc032c40f
 ffffc90000a13d18 ffffffff841a88ca ffff88000d946358 0000000000000000
Call Trace:
 [<ffffffffc032c346>] ? exit_btrfs_fs+0x1cc3a/0x344d4 [btrfs]
 [<ffffffff845d5bd8>] dump_stack+0x4c/0x7f
 [<ffffffffc032c40f>] ? exit_btrfs_fs+0x1cd03/0x344d4 [btrfs]
 [<ffffffff841a88ca>] report_size_overflow+0x5a/0x60
 [<ffffffffc029ce72>] btrfs_sync_file+0xa2/0x570 [btrfs]
 [<ffffffff841d955e>] vfs_fsync_range+0x4e/0xd0
 [<ffffffff841d964c>] do_fsync+0x3c/0x70
 [<ffffffff841d9945>] SyS_fsync+0x15/0x30
 [<ffffffff845dbdf0>] entry_SYSCALL_64_fastpath+0x12/0x8a


in virtualbox
Code: Select all
PAX: size overflow detected in function btrfs_sync_file fs/btrfs/file.c:1871 cicus.676_106 max, count: 295,
CPU: 1 PID: 158 Comm: systemd-journal Tainted: G           O    4.2.4.201510222059-1-grsec #1
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
 ffffffffa9a0a847 5fbccd5de719e070 0000000000000000 ffffffffc0212346
 ffffc900005e3d28 ffffffffa95d5bd8 00000000000000a4 ffffffffc021240f
 ffffc900005e3d58 ffffffffa91a88ca ffff88007d2a5d08 0000000000000000
Call Trace:
 [<ffffffffc0212346>] ? exit_btrfs_fs+0x1cc3a/0x344d4 [btrfs]
 [<ffffffffa95d5bd8>] dump_stack+0x4c/0x7f
 [<ffffffffc021240f>] ? exit_btrfs_fs+0x1cd03/0x344d4 [btrfs]
 [<ffffffffa91a88ca>] report_size_overflow+0x5a/0x60
 [<ffffffffc0182e72>] btrfs_sync_file+0xa2/0x570 [btrfs]
 [<ffffffffa91d955e>] vfs_fsync_range+0x4e/0xd0
 [<ffffffffa91d964c>] do_fsync+0x3c/0x70
 [<ffffffffa91d9945>] SyS_fsync+0x15/0x30
 [<ffffffffa95dbdf0>] entry_SYSCALL_64_fastpath+0x12/0x8a
bellsyaorin
 
Posts: 1
Joined: Fri Oct 23, 2015 5:21 pm

Re: PAX: size overflow detected in function btrfs_sync_file

Postby ephox » Sun Nov 01, 2015 4:09 pm

bellsyaorin wrote:
Code: Select all
PAX: size overflow detected in function btrfs_sync_file fs/btrfs/file.c:1871 cicus.676_106 max, count: 295,
CPU: 1 PID: 158 Comm: systemd-journal Tainted: G           O    4.2.4.201510222059-1-grsec #1
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
 ffffffffa9a0a847 5fbccd5de719e070 0000000000000000 ffffffffc0212346
 ffffc900005e3d28 ffffffffa95d5bd8 00000000000000a4 ffffffffc021240f
 ffffc900005e3d58 ffffffffa91a88ca ffff88007d2a5d08 0000000000000000
Call Trace:
 [<ffffffffc0212346>] ? exit_btrfs_fs+0x1cc3a/0x344d4 [btrfs]
 [<ffffffffa95d5bd8>] dump_stack+0x4c/0x7f
 [<ffffffffc021240f>] ? exit_btrfs_fs+0x1cd03/0x344d4 [btrfs]
 [<ffffffffa91a88ca>] report_size_overflow+0x5a/0x60
 [<ffffffffc0182e72>] btrfs_sync_file+0xa2/0x570 [btrfs]
 [<ffffffffa91d955e>] vfs_fsync_range+0x4e/0xd0
 [<ffffffffa91d964c>] do_fsync+0x3c/0x70
 [<ffffffffa91d9945>] SyS_fsync+0x15/0x30
 [<ffffffffa95dbdf0>] entry_SYSCALL_64_fastpath+0x12/0x8a

You can follow this issue here:
viewtopic.php?f=1&t=4284&p=15617#p15617
ephox
 
Posts: 134
Joined: Tue Mar 20, 2012 4:36 pm

Re: PAX: size overflow detected in function btrfs_sync_file

Postby ephox » Sun Nov 01, 2015 4:28 pm

bellsyaorin wrote:
Code: Select all
PAX: size overflow detected in function try_merge_map fs/btrfs/extent_map.c:238 cicus.101_102 max, count: 13
CPU: 0 PID: 246 Comm: login Not tainted 4.2.4.201510222059-1-grsec #1
Hardware name: VMware, Inc. VMware7,1/440BX Desktop Reference Platform, BIOS VMW71.00V.0.B64.1507021939 07/0
 ffffffff84a0a847 52c0beb73ef9e8ec 0000000000000000 ffffffffc032c45d
 ffffc90000ad35a8 ffffffff845d5bd8 000000000000009b ffffffffc032c473
 ffffc90000ad35d8 ffffffff841a88ca ffff88000d9abdb0 ffff88000d86f1d0
Call Trace:
 [<ffffffffc032c45d>] ? exit_btrfs_fs+0x1cd51/0x344d4 [btrfs]
 [<ffffffff845d5bd8>] dump_stack+0x4c/0x7f
 [<ffffffffc032c473>] ? exit_btrfs_fs+0x1cd67/0x344d4 [btrfs]
 [<ffffffff841a88ca>] report_size_overflow+0x5a/0x60
 [<ffffffffc029e567>] try_merge_map+0x207/0x320 [btrfs]
 [<ffffffffc029e8bf>] add_extent_mapping+0x11f/0x1a0 [btrfs]
 [<ffffffffc0285189>] btrfs_get_extent+0x619/0xdd0 [btrfs]
 [<ffffffffc02a4f8e>] ? insert_state+0x9e/0x120 [btrfs]
 [<ffffffffc02a9f60>] __do_readpage+0x280/0xd20 [btrfs]
 [<ffffffffc02a6781>] ? lock_extent_bits+0x91/0x220 [btrfs]
 [<ffffffffc0284b70>] ? btrfs_direct_IO+0x3a0/0x3a0 [btrfs]
 [<ffffffffc02aaefc>] __extent_readpages.constprop.25+0x2dc/0x320 [btrfs]
 [<ffffffff8411de7a>] ? __add_to_page_cache_locked+0x1ea/0x250
 [<ffffffffc0284b70>] ? btrfs_direct_IO+0x3a0/0x3a0 [btrfs]
 [<ffffffffc02ab8f4>] extent_readpages+0x1e4/0x1f0 [btrfs]
 [<ffffffffc0284b70>] ? btrfs_direct_IO+0x3a0/0x3a0 [btrfs]
 [<ffffffff8417460d>] ? alloc_pages_current+0x8d/0x100
 [<ffffffffc0282d55>] btrfs_readpages+0x35/0x50 [btrfs]
 [<ffffffff8412dd5b>] __do_page_cache_readahead+0x1fb/0x290
 [<ffffffff8412ded9>] ondemand_readahead+0xe9/0x2f0
 [<ffffffff8412e23a>] page_cache_sync_readahead+0x4a/0x80
 [<ffffffff841207e8>] generic_file_read_iter+0x5e8/0x7a0
 [<ffffffff8419eb36>] __vfs_read+0x106/0x130
 [<ffffffff8419f746>] vfs_read+0xd6/0x250
 [<ffffffff841a0a09>] SyS_read+0x59/0xd0
 [<ffffffff845dbdf0>] entry_SYSCALL_64_fastpath+0x12/0x8a


The block_len can be ULONG_MAX or little less than ULONG_MAX but I don't know whether this overflow is intentional or not so could you please ask the btrfs developers about it?
ephox
 
Posts: 134
Joined: Tue Mar 20, 2012 4:36 pm

Re: PAX: size overflow detected in function btrfs_sync_file

Postby Dwokfur » Sun Dec 20, 2015 5:02 pm

EDITED: wrong thread, sorry...
Dwokfur
 
Posts: 99
Joined: Tue Jun 08, 2004 10:07 am


Return to grsecurity support

cron