There's a situation where the directory structure and the inobt
thinks the inode is free, but the inode on disk thinks it is still
in use. XFS should detect it and prevent the kernel from oopsing on
lookup.
Signed-off-by: Zorro Lang <zlang@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Fuzz every field of every structure and then try to write the
filesystem, to see how many of these writes can crash the kernel.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Bad characters likes tailing asterisk, slash or quote in xfs_db
field string can trigger a xfs_db crash. This bug has been fixed by
xfsprogs commit 945e47e2fcc5 ("xfs_db: fix crash when field list
selector string has trailing slash").
Signed-off-by: Zorro Lang <zlang@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Recently we found out xfs_repair were not repairing root inode
parent pointer when root inode is on short-form and parent points to
an invalid inode number (refer to: "xfs_repair: Fix root inode's
parent when it's bogus for sf directory" on xfs-devel list).
This test checks if xfs_repair successfully repair the filesystem in
the scenario mentioned before.
Signed-off-by: Marco Benatto <mbenatto@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
In "xfs: fix fdblocks accounting w/ RMAPBT per-AG reservation", we fixed
the per-ag reservation code so that we always decrease fdblocks by the
reserved size because rmapbt blocks are counted as free space.
The primary symptom of this bug is that if the rmapbt has expanded since
mount time, the disk block counters reported via statfs will change
across a remount. Therefore, we exercise this as a regression test.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Make sure that all of our commands that can print geometry
information all print the /same/ information.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
If a malicious XFS contains a block+ format directory wherein the
directory inode's core.mode is corrupted, and there are
subdirectories of the corrupted directory, an attempt to traverse up
the directory tree by running xfs_scrub will crash the kernel in
__xfs_dir3_data_check.
Signed-off-by: Xiao Yang <yangx.jy@cn.fujitsu.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Update the group files to annotate those tests which have a
_require_xfs_io_command for punch, collapse, insert, and zero. This
makes it easier to exclude tests that use one of these fallocate
commands. Or if you want to specifically test for those fallocate
commands you can do this.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
I'm going to add a bunch of tests for swap files, so create a group
for them and add the existing tests.
Signed-off-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Test case for superblock shrinkers running while the filesystem is
being set up and/or torn down and tripping over inconsistent state.
Signed-Off-By: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Fuzzing has recently uncovered a couple of conditions where we don't
detect corruptions that reallocate already allocated inodes. This
test exercises those cases, and checks that we shut down the
filesystem appropriately when such a corruption occurs.
Signed-Off-By: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
There are a bunch of tests that are run by the auto group that are
marked dangerous. This was done because the test exercised a crash
or other fatal error that has since been fixed. Remove the dangerous
tag from the auto tests that pass on a 4.17-rc3 kernel as they are
not dangerous anymore.
Signed-Off-By: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Test description says: "This is the same test as generic/156 except
that we also check the inode reflink flag.", only since commit
f1c3fee ("xfs: remove NOCOW_FL testing from test") it is almost
exactly the same test as generic/156.
almost - because since xfs/132 diverged from generic/156 the change
911efb0 ("reflink: change to relative margins") is only applied to
the original test.
Anyway, there doesn't seem to be a reason to keep this duplicated
test anymore, so remove it.
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
The XFS filestreams allocator caches dir inode -> agno mappings in
an MRU mechanism that holds elements in memory for an amount of time
and then cleans up expired elements in the background. The elements
typically held inode pointers without holding a reference to the
associated inode. This means that if the inode is reclaimed before
an expired entry is cleaned up, the MRU reaper can access freed
memory and cause a panic.
Test for this problem by performing continuous filestreams
allocations under short-lived parent directory inodes. This will
produce KASAN use-after-free splats if enabled during the test.
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
From the kernel patch that this test examines ("xfs: detect agfl
count corruption and reset agfl"):
"The struct xfs_agfl v5 header was originally introduced with
unexpected padding that caused the AGFL to operate with one less
slot than intended. The header has since been packed, but the fix
left an incompatibility for users who upgrade from an old kernel
with the unpacked header to a newer kernel with the packed header
while the AGFL happens to wrap around the end. The newer kernel
recognizes one extra slot at the physical end of the AGFL that the
previous kernel did not. The new kernel will eventually attempt to
allocate a block from that slot, which contains invalid data, and
cause a crash.
"This condition can be detected by comparing the active range of the
AGFL to the count. While this detects a padding mismatch, it can
also trigger false positives for unrelated flcount corruption. Since
we cannot distinguish a size mismatch due to padding from unrelated
corruption, we can't trust the AGFL enough to simply repopulate the
empty slot.
"Instead, avoid unnecessarily complex detection logic and and use a
solution that can handle any form of flcount corruption that slips
through read verifiers: distrust the entire AGFL and reset it to an
empty state. Any valid blocks within the AGFL are intentionally
leaked. This requires xfs_repair to rectify (which was already
necessary based on the state the AGFL was found in). The reset
mitigates the side effect of the padding mismatch problem from a
filesystem crash to a free space accounting inconsistency."
This test exercises the reset code by mutating a fresh filesystem to
contain an agfl with various list configurations of correctly wrapped,
incorrectly wrapped, not wrapped, and actually corrupt free lists; then
checks the success of the reset operation by fragmenting the free space
btrees to exercise the agfl. Kernels without this reset fix will shut
down the filesystem with corruption errors.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
The XFS rmapbt extent swap mechanism performs an extent by extent
swap to ensure the rmapbt is rectified with the appropriate extent
owner information after the operation. This implementation suffers
from a corner case that requires extra reservation if the swap
operation results in bouncing one of the associated inodes between
extent and btree formats. When this corner case occurs, it results
in a transaction block reservation overrun and possible corruption
of the free space accounting.
This regression test provides coverage for this corner case. It
creates two files with a large enough extent count to require btree
format, regardless of inode size, and performs a sequence of extent
swaps between them with a decreasing extent count until all extents
are removed from the file(s). This ensures that one of the swaps
covers the btree <-> extent fork format boundary case.
This test reproduces fs corruption on rmapbt enabled filesystems
running on kernels without the associated extent swap fix.
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Add three tests to look for quota bugs in xfs reflink. The first
test looks for problems when we have speculative cow reservations in
memory, we chown the file, but the reservations don't move to the
new owner. The second test checks that we remembered to dqattach
the inodes before performing reflink operations. The third is a
stress test for reflink quota handling near enospc and helped us to
find a directio cow write corruption bug when free space is
fragmented.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
If log stripe unit isn't a multiple of the fs blocksize and
mounting, the invalid sb_logsunit leads to crash as soon as we try
to write to the log.
Signed-off-by: xiao yang <yangx.jy@cn.fujitsu.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
When the first writeback and the retried writeback of dquota buffer
get the same IO error, XFS will let xfsaild to restart the writeback
and xfs_qm_dqflush_done() will not be invoked. xfsaild will try to
re-push the quota log item in AIL, the push will return early
everytime after checking xfs_dqflock_nowait(), and xfsaild will try
to push it again.
IOWs, AIL will never be empty, and the umount process will wait for
the drain of AIL, so the umount process hangs.
Signed-off-by: Hou Tao <houtao1@huawei.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Add a couple of tests to check that we don't leak inodes or dquots
if CoW recovery fails and therefore the mount fails.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
XFS had a bug that resulted in an unexpected NULL buffer during
unlink of an inode with a multi-level attr fork tree. This occurred
due to a stale reference to content in a released/reclaimed buffer.
Use the XFS buffer LRU reference count error injection tag to
recreate the conditions for the bug. Create a file with a
multi-level attr fork tree and then unlink it with buffer caching
disabled.
Commit f35c5e10c6ed ("xfs: reinit btree pointer on attr tree
inactivation walk") fixed the bug.
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
As of 2007, metadump has an interesting "feature" where it discards
directory extents that are longer than 1000 (originally 20) blocks.
This ostensibly was to protect metadump from corrupt bmbt records, but
it also has the effect of omitting from the metadump valid long extents.
The end result is that we create incomplete metadumps, which is
exacerbated by the lack of warning unless -w is passed.
So now that we've fixed the default threshold to MAXEXTLEN, check that
the installed metadump no longer exhibits this behavior.
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
Zorro Lang
Darrick J. Wong
Marco Benatto
Xiao Yang
Theodore Ts'o
Omar Sandoval
Dave Chinner
Amir Goldstein
Brian Foster
Hou Tao
Xiong Zhou