Previously, our XFS fuzzing efforts were limited to using the xfs_db
blocktrash command to scribble garbage all over a block. This is
pretty easy to discover; it would be far more interesting if we could
fuzz individual fields looking for unhandled corner cases. Since we
now have an online scrub tool, use it to check for our targeted
corruptions prior to the usual steps of writing to the FS, taking it
offline, repairing, and re-checking.
These tests use the new xfs_db 'fuzz' command to test corner case
handling of every field. The 'print' command tells us which fields
are available, and the fuzz command can write zeroes or ones to the
field; set the high, middle, or low bit; add or subtract numbers; or
randomize the field. We loop through all fields and all fuzz verbs to
see if we can trip up the kernel.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Create some routines to help us perform targeted fuzzing of individual
fields in various XFS structures. Specifically, we want the caller to
drop the xfs_db iocursor on the victim field; from there, the scripts
should discover all available fields and fuzzing verbs, and try each
fuzz verb on every available field.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Create a helper function to create a populated FS image and dump the
metadata into a file on the test device, with the purpose of allowing
future (fuzzer) invocations of _populate_fs use the cached metadata to
save time.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Move some fuzzing helper functions into a new common/fuzzy file.
We'll add a lot more fuzzing helpers in subsequent patches.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
There were some silly errors in _scratch_fuzz_modify such that it
wasn't really doing much of anything because of undefined variables.
(Sloppy refactoring when converting xfsfuzz.sh into xfstests.)
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Be a little more flexible in how much we fill up a pre-populated
filesystem. For the field fuzzing tests, we don't need the extra
space/inode usage and therefore won't want much at all.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Back when I created common/populate, I thought it was sufficient to
_require the tools that the populate functions need in the main
file. This turned out to be a bit sloppy, so move them into a
helper function and call it from everything that uses populate.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
We have three new metadata types -- rmapbt, rtrmapbt, and refcountbt.
Ensure that we populate the scratch fs with all three.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Test that an incremental send operation works when in both snapshots
there are two directory inodes that have the same number but
different generations and have an entry with the same name that
corresponds to different inodes in each snapshot.
The btrfs issue is fixed by the following patch for the linux kernel:
"Btrfs: incremental send, do not issue invalid rmdir operations"
Signed-off-by: Robbie Ko <robbieko@synology.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Test that an incremental send operation works after moving a
directory into a new parent directory, deleting its previous parent
directory and creating a new inode that has the same inode number as
the old parent.
This issue is fixed by the following patch for the linux kernel:
"Btrfs: incremental send, do not delay rename when parent inode is new"
Signed-off-by: Robbie Ko <robbieko@synology.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Test that an incremental send operation does not fail when a new
inode replaces an old inode that has the same number but different
generation, and both are direct children of the subvolume/snapshot
root.
This is fixed by the following patch for the linux kernel:
"Btrfs: send, fix failure to rename top level inode due to name
collision"
Signed-off-by: Robbie Ko <robbieko@synology.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
In addition to testing xfs_repair on inodes with malformed mode,
and fstat of those inodes on a mounted fs, try to also list content
of mock directory and readlink of mock symlink.
Readdir of mock directory triggers XFS assertion on kernel 4.9 with
XFS_DEBUG=y
XFS: Assertion failed:
rval == 0 || args->dp->i_d.di_size == args->geo->blksize,
file: /home/amir/build/src/linux/fs/xfs/libxfs/xfs_dir2.c, line: 634
A fix patch, as suggested by Darrick, changes this ASSERT() to
return -EFSCORRUPTED ("xfs: sanity check directory inode di_size").
Merging this test should be deferred to after fix patch is merged.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
In addition to testing xfs_repair on inodes with malformed mode,
also test fstat of those inodes on a mounted fs.
This additional test is quite noisy with dmesg warnings, so
check dmesg has been disabled.
This test fails on kernel 4.9 because a zero size inode is not
identified as malformed dir. A patch has been sent to fix this
("xfs: sanity check directory inode di_size").
This test may be merged before the fix patch.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Test mkfs against thin provision device, which has very small
backing size and very big virtual size. mkfs should return error
when it hits EIO.
Signed-off-by: Boyang Xue <bxue@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Wait for device to be fully settled so that 'dmsetup remove' doesn't
fail due to EBUSY.
Signed-off-by: Boyang Xue <bxue@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
This is a simple script to compare failures across runs.
Given files containing stdout from several runs, each of which contains
a Failures: line, it will print a table of all failures for each run.
Test subdir names are abbreviated for compactness, i.e. generic->g.
For 7 results files named test 1 through test 7:
Failures:
g/075 g/082 g/209 g/233 g/270 g/388 x/004 x/073 x/076
-----------------------------------------------------
g/082 g/233 x/004 x/073 test1
g/082 g/233 x/004 x/073 x/076 test2
g/082 x/004 x/073 x/076 test3
g/082 g/388 x/004 x/073 test4
g/082 g/270 x/004 x/073 test5
g/082 x/004 x/073 test6
g/075 g/082 g/209 g/233 x/004 x/073 test7
This lets us easily spot unique failures and outliers.
This could be enhanced to output CSV etc, but for now I think it's
helpful to visualize changes in failures across multiple runs.
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
The command btrfs-show-super is not supposed to be distributed but
was useful for testing. The same functionality is now present as
'btrfs inspect-internal dump-super', let's detect which one is
available and use it in btrfs/011 that fails with btrfs-progs 4.8.4+
Signed-off-by: David Sterba <dsterba@suse.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Run 4 process pairs, each competing over copy up of 1K files
in 1 directory. One opponent touches all files in the directory
and the other truncates all files in the directory.
This test does NOT check for concurrent copy up support. It only
fails on unexpected errors of any of the touch/truncate operations.
The test full output should demonstrate the expected results -
for kernel with concurrent copy up support, truncate workers are
not delayed by touch workers. As a result, truncate workers will
finish their work much sooner than a test run without concurrent
copy up support.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
generic/401 failed on RHEL6.8GA because "--output=xxx"
option is not supported by df. So we remove it.
Signed-off-by: Xiao Yang <yangx.jy@cn.fujitsu.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
And drop support for some really old kernels to clean things up.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Without this the epressions in generic/256 will fail on a system
where /bin/sh is the Default (e.g. modern Debian versions).
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
This was only used to check for mkfs.xfs -n version=ci support,
which is carried in xfsprogs >= 2.10. _require_xfs_mkfs_ciname() is
now used to explicitly check for the mkfs parameter.
Suggested-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: David Disseldorp <ddiss@suse.de>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Xiao Yang
Darrick J. Wong
Filipe Manana
Amir Goldstein
Boyang Xue
Eric Sandeen
David Sterba
Lakshmipathi.G
Christoph Hellwig
David Disseldorp