From patchwork Thu May 24 09:32:12 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiao Yang X-Patchwork-Id: 10424567 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6880F6032C for ; Thu, 24 May 2018 12:07:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4B5B42893C for ; Thu, 24 May 2018 12:07:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3CA6929456; Thu, 24 May 2018 12:07:22 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7DCAC2893C for ; Thu, 24 May 2018 12:07:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966690AbeEXMHU (ORCPT ); Thu, 24 May 2018 08:07:20 -0400 Received: from mail.cn.fujitsu.com ([183.91.158.132]:55484 "EHLO heian.cn.fujitsu.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S966542AbeEXJnx (ORCPT ); Thu, 24 May 2018 05:43:53 -0400 X-IronPort-AV: E=Sophos;i="5.43,368,1503331200"; d="scan'208";a="40300779" Received: from localhost (HELO cn.fujitsu.com) ([10.167.33.5]) by heian.cn.fujitsu.com with ESMTP; 24 May 2018 17:43:51 +0800 Received: from G08CNEXCHPEKD03.g08.fujitsu.local (unknown [10.167.33.85]) by cn.fujitsu.com (Postfix) with ESMTP id 9A9174B40414; Thu, 24 May 2018 17:43:50 +0800 (CST) Received: from RHEL7U5Alpha_SERVER.g08.fujitsu.local (10.167.220.185) by G08CNEXCHPEKD03.g08.fujitsu.local (10.167.33.89) with Microsoft SMTP Server (TLS) id 14.3.399.0; Thu, 24 May 2018 17:43:50 +0800 From: Xiao Yang To: CC: , , Xiao Yang Subject: [PATCH] xfs: Regression test for vulnerable directory integrity check Date: Thu, 24 May 2018 17:32:12 +0800 Message-ID: <1527154332-13234-1-git-send-email-yangx.jy@cn.fujitsu.com> X-Mailer: git-send-email 1.8.3.1 MIME-Version: 1.0 X-Originating-IP: [10.167.220.185] X-yoursite-MailScanner-ID: 9A9174B40414.A58CA X-yoursite-MailScanner: Found to be clean X-yoursite-MailScanner-From: yangx.jy@cn.fujitsu.com Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If a malicious XFS contains a block+ format directory wherein the directory inode's core.mode is corrupted, and there are subdirectories of the corrupted directory, an attempt to traverse up the directory tree by running xfs_scrub will crash the kernel in __xfs_dir3_data_check. Signed-off-by: Xiao Yang --- tests/xfs/448 | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ tests/xfs/448.out | 2 ++ tests/xfs/group | 1 + 3 files changed, 93 insertions(+) create mode 100755 tests/xfs/448 create mode 100644 tests/xfs/448.out diff --git a/tests/xfs/448 b/tests/xfs/448 new file mode 100755 index 0000000..bc151a4 --- /dev/null +++ b/tests/xfs/448 @@ -0,0 +1,90 @@ +#! /bin/bash +# FS QA Test No. 448 +# +# Regression test for commit: +# 46c5973 ("xfs: harden directory integrity checks some more") +# +# If a malicious XFS contains a block+ format directory wherein +# the directory inode's core.mode is corrupted, and there are +# subdirectories of the corrupted directory, an attempt to traverse +# up the directory tree by running xfs_scrub will crash the +# kernel in __xfs_dir3_data_check. +# +# Notice: +# we should have non fatal asserts configured, because assert +# failures triggered by the intentional corrupt would crash system. +# +#----------------------------------------------------------------------- +# Copyright (c) 2018 FUJITSU. All Rights Reserved. +# Author: Xiao Yang +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it would be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write the Free Software Foundation, +# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA +#----------------------------------------------------------------------- + +seq=`basename "$0"` +seqres="$RESULT_DIR/$seq" +echo "QA output created by $seq" + +here=`pwd` +tmp=/tmp/$$ +status=1 # failure is the default! +trap "_cleanup; exit \$status" 0 1 2 3 15 + +_cleanup() +{ + rm -rf $tmp.* +} + +# get standard environment, filters and checks +. ./common/rc +. ./common/filter +. ./common/populate +. ./common/fuzzy + +# real QA test starts here +_supported_os Linux +_supported_fs xfs +_require_scratch +_require_scrub +_require_scratch_nocheck +# Corrupt XFS on purpose, and skip if assert failures would crash system. +_require_no_xfs_bug_on_assert + +rm -f "$seqres.full" + +# Format and mount +_scratch_mkfs > $seqres.full 2>&1 || _fail "mkfs failed" +_scratch_mount + +# Create a block+(e.g. leaf) format directory +dblksz="$(xfs_info "${SCRATCH_MNT}" | grep naming.*bsize | sed -e 's/^.*bsize=//g' -e 's/\([0-9]*\).*$/\1/g')" +__populate_create_dir "${SCRATCH_MNT}/dir_leaf" "$((dblksz / 12))" +dino=$(stat -c "%i" "${SCRATCH_MNT}/dir_leaf") + +# Corrupt the directory inode's core.mode +_scratch_unmount +setmode="0100755" +_scratch_xfs_set_metadata_field "core.mode" "$setmode" "inode $dino" >> $seqres.full +getmode=$(_scratch_xfs_get_metadata_field "core.mode" "inode $dino") +[ "$getmode" != "$setmode" ] && _notrun "failed to set core.mode" + +# Check a mounted XFS (online) +_scratch_mount +$XFS_SCRUB_PROG -d -T -v -n $SCRATCH_MNT >> $seqres.full 2>&1 + +echo "Silence is golden" + +# success, all done +status=0 +exit diff --git a/tests/xfs/448.out b/tests/xfs/448.out new file mode 100644 index 0000000..b6f0a53 --- /dev/null +++ b/tests/xfs/448.out @@ -0,0 +1,2 @@ +QA output created by 448 +Silence is golden diff --git a/tests/xfs/group b/tests/xfs/group index 51326d9..dd39d08 100644 --- a/tests/xfs/group +++ b/tests/xfs/group @@ -445,3 +445,4 @@ 445 auto quick filestreams 446 auto quick 447 auto mount +448 auto quick fuzzers