Commit Graph

124 Commits

Author SHA1 Message Date
Richard Wareing ea817058b0 xfs: Add test for CVE-2017-14340
Verify kernel doesn't panic when user attempts to set realtime flags
on non-realtime FS, using kernel compiled with CONFIG_XFS_RT.
Unpatched kernels will panic during this test.  Kernels not compiled
with CONFIG_XFS_RT should pass test.

This bug was fixed via commit b31ff3cdf540 ("xfs:
XFS_IS_REALTIME_INODE() should be false if no rt device present") on
the main kernel tree.

[eguan: don't assume fixed position when grepping 't' and add some
comments about why we do this, also remove testfile after test]

Signed-off-by: Richard Wareing <rwareing@fb.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-09-25 00:14:00 +08:00
xiao yang 7ef45e8a38 xfs/115: add missing 115 into group file
Signed-off-by: xiao yang <yangx.jy@cn.fujitsu.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-09-18 10:45:57 +08:00
Darrick J. Wong 1c7f4dbf37 xfs: test rmapbt updates are correct with insert/collapse range
Make sure that we update the rmapbt correctly when we collapse-range
a file and the extents on both sides of the hole can be merged.  We
can construct this pretty trivially with insert-range and write, so
test that too.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-09-03 12:20:00 +08:00
Darrick J. Wong c7daab5f35 xfs: test fuzzing every field of a dquot
See what happens when we fuzz every field of a quota information structure.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-08-24 17:05:19 +08:00
Darrick J. Wong 86b3f79bbe xfs: test xfs_db fuzz command verbs
Ensure that the fuzz command does what it says.

[eguan: fixed test failures on non-CRC XFS]

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-08-22 15:08:05 +08:00
Brian Foster 1cc5517771 xfs: test for log recovery failure after tail overwrite
XFS is susceptible to log recovery problems if the fs crashes under
certain circumstances. If the tail has been pinned for long enough
to the log to fill and the next batch of log buffer submissions
happen to fail, the filesystem shuts down having potentially
overwritten part of the range between the last good tail->head range
in the log. This causes log recovery to fail with crc mismatch or
invalid log record errors.

Add a test that uses XFS DEBUG mode error injection to force the
tail overwrite condition with a known bad (crc mismatch) log write
and tests that log recovery succeeds. Note that this problem is
currently only reproducible with larger (non-default) log buffer
sizes (i.e., '-o logbsize=256k') or smaller block sizes (1k).

Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-08-18 13:39:34 +08:00
Bill O'Donnell 6a6e65aa50 xfs: test xfs_db to ensure type size taken into account with new type
xfs_db should take type size into account when setting type.
If type size isn't updated whenever type is set, a false crc
error can occur due to the stale size. This test checks for
that false crc error.

Signed-off-by: Bill O'Donnell <billodo@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-07-28 18:53:51 +08:00
Eric Biggers 5cb1f2b055 tests: remove xfs/057 and xfs/058
These two IRIX and XFS-specific tests were just placeholders which
didn't actually test anything.  It also seems they were meant to use the
acl_get and acl_test programs, but those weren't even being compiled.
Get rid of all this unused stuff.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-07-24 12:22:12 +08:00
Eric Biggers 1ce90e01a7 tests: remove xfs/114 and xfs/115
These two IRIX and XFS-specific tests tested the "parent pointer"
feature which is not implemented by XFS on Linux.  Just remove them.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-07-24 12:22:07 +08:00
Darrick J. Wong 1b6d979780 xfs: scrub while appending to a file
It turns out that there was a bug in xfs_bmap_count_blocks wherein
the block count returned would count or not count delalloc blocks
depending on the fork format.  This is a bug that is easily exposed
via scrub, so check the output of that function here -- the buggy
version of the function produces online fsck errors.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-07-03 20:25:01 +08:00
Darrick J. Wong f3a5cbbb34 xfs: test freeze/rmap repair race
The rmapbt repair code plays some dirty tricks with the fs freezer
to avoid running afoul of regular xfs locking requirements.  Add a
test to check that filesystem write activities do not deadlock with
the repair program.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-06-29 17:54:13 +08:00
Darrick J. Wong ca9c677346 xfs: seek data and holes that are in the CoW fork only
Create a file with a hole in the data fork and CoW reservations in the
same region in the CoW fork.  Ensure that SEEK_HOLE/DATA find the data.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-06-22 23:25:32 +08:00
Darrick J. Wong 6813e5213d xfs: don't allow realtime swap files
Linux swapfiles use bmap which has no ability to tell the swap code
that the blocks its reporting aren't actually on the data device.
Therefore, swapon on a realtime file could corrupt random blocks on
the data device, so we must ensure that swapon cannot happen.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-06-20 17:15:28 +08:00
Eric Sandeen 9343320e67 xfs: test fragmented multi-fsb readdir
Regression test for kernel commit:
023cc840 xfs: handle array index overrun in xfs_dir2_leaf_readbuf()

See commit for detailed problem description.

tl;dr: readahead on weirdly fragmented multi-block directories
was broken.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-05-04 11:33:29 +08:00
Bill O'Donnell ecc7b5c0ba xfs: xfs_growfs target path must be an active xfs mountpoint
xfs_growfs manpage clearly states that the target path must be an
active xfs mountpoint. This is a test to ensure that if the target
path isn't an active xfs mountpoint, the command is rejected. The
purpose is to check the command response, but not necessarily the
functionality of xfs_growfs. Test cases include absolute paths,
relative paths, symbolic links, and bind mounts.

Signed-off-by: Bill O'Donnell <billodo@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-04-28 14:52:54 +08:00
Zorro Lang 9518ef6402 xfs: xfs_repair should junk empty attribute leaf blocks
There was a bug during log replay, the attr/attr3 leaf verifier
reported corruption when encountering a leaf attribute with a
count of 0 in the header, as below:

Metadata corruption detected at xfs_attr3_leaf block 0x480988/0x1000

commit f714016 from xfsprogs has fixed this bug. This test case
will emulate this corruption by xfs_db and use xfs_repair to fix
it.

Signed-off-by: Zorro Lang <zlang@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-04-25 19:33:08 +08:00
Darrick J. Wong 161ba4c1b7 xfs: stress test xfs_scrub
Three new tests:

- Repair files that are mapped into memory in running programs
- Run scrub -n concurrently with fsstress
- Run scrub -y concurrently with fsstress

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-03-01 11:36:41 +08:00
Darrick J. Wong 58a0630b2b xfs/348: classify this as a fuzzer test
xfs/348 is a fuzzer test since it calls xfs_db to break the scratch fs,
so put it in the fuzzers group.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-03-01 11:24:23 +08:00
Xiong Zhou 456581661b xfs: test per-inode DAX flag by IO
In a DAX mountpoint, do IO betwen files with and
without DAX per-inode flag. We do mmap, both
O_DIRECT and buffered read/write IO in this case.
Then test again in the same device without dax
mountoption.

Add help _require_scratch_dax to make sure we can
test DAX feature on SCRATCH_DEV.

Add mmap dio test programme to test read/write
between a mmap area of one file and another file
directly or buffered, with different size.

Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Signed-off-by: Xiong Zhou <xzhou@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-02-19 07:59:33 +08:00
Brian Foster e78ae074b2 xfs: stress XFS delalloc indirect block reservations
This test is based on generic/033, which originally used zero range
operations to reproduce indlen reservation problems. Zero range now
includes a pagecache flush before it updates extents, which means
generic/033 is no longer able to reproduce the problem it was
originally written to test.

Create a new test that uses an XFS-specific mechanism (in DEBUG
mode) to induce delalloc extent splits and reproduce the problem
originally reproduced by generic/033. In addition, update the test
to include a larger buffered write pattern that is known to
reproduce premature indlen exhaustion on delalloc extents.

Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-02-14 15:35:15 +08:00
Theodore Ts'o 4a2e9b0c05 generic: add shutdown group
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-02-04 14:16:43 +08:00
Darrick J. Wong 614e33f1b5 xfs: test xfs_db source command
Make sure that the 'source' command works correctly whether supplied
via command line or interactive prompt.

You probably want "xfs_db: fix the 'source' command when passed as a
-c option" in xfsprogs.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-01-27 16:06:12 +08:00
Darrick J. Wong f5f0c11a67 xfs: fuzz every field of every structure
Previously, our XFS fuzzing efforts were limited to using the xfs_db
blocktrash command to scribble garbage all over a block.  This is
pretty easy to discover; it would be far more interesting if we could
fuzz individual fields looking for unhandled corner cases.  Since we
now have an online scrub tool, use it to check for our targeted
corruptions prior to the usual steps of writing to the FS, taking it
offline, repairing, and re-checking.

These tests use the new xfs_db 'fuzz' command to test corner case
handling of every field.  The 'print' command tells us which fields
are available, and the fuzz command can write zeroes or ones to the
field; set the high, middle, or low bit; add or subtract numbers; or
randomize the field.  We loop through all fields and all fuzz verbs to
see if we can trip up the kernel.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-01-27 16:06:12 +08:00
Amir Goldstein 726f8c357f xfs: test handling of invalid inode modes
Set all possible file type values for different types of files
and verify that xfs_repair detects the correct errors.

When setting invalid file type values (e.g. core.mode = 0170644),
all files are expected to have been junked by xfs_repair.

When setting valid file type values to non matching file types,
xfs_repair would either detect wrong format and junk the file, e.g.:
  would have junked entry "DATA" in directory PARENT_INO
or detect a ftype mismatch error, e.g.:
  would fix ftype mismatch (5/3) in directory/child PARENT_INO/FIFO_INO

If ftype feature is enabled, when setting file type to one of the
special types (i.e. FIFO(1), CHRDEV(2),BLKDEV(6),SOCKET(14)),
xfs_repair is expected to detect ftype mismatch error. Otherwise,
xfs_repair is not expected to detect ftype mismatch error.

Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-01-15 13:56:45 +08:00
Darrick J. Wong 466369dc92 xfs/ext4: check negative inode size
Craft a malicious filesystem image with a negative inode size,
then try to trigger a kernel DoS by appending data to the file.
Ideally this should trigger verifier errors instead of hanging.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
2017-01-15 13:56:45 +08:00