diff mbox

[V2] xfs: test inobt/on disk free state mismatches

Message ID 20180507230551.GJ10363@dastard (mailing list archive)
State New, archived
Headers show

Commit Message

Dave Chinner May 7, 2018, 11:05 p.m. UTC
From: Dave Chinner <dchinner@redhat.com>

Fuzzing has recently uncovered a couple of conditions where we don't
detect corruptions that reallocate already allocated inodes. This
test exercises those cases, and checks that we shut down the
filesystem appropriately when such a corruption occurs.

Signed-Off-By: Dave Chinner <dchinner@redhat.com>
---
V2:
- fix method of calling xfs_db to use correct helpers.

 tests/{shared/003 => xfs/450} | 41 ++++++++++++++++++++++-------------------
 tests/xfs/450.out             | 26 ++++++++++++++++++++++++++
 tests/xfs/group               |  1 +
 3 files changed, 49 insertions(+), 19 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe fstests" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Eryu Guan May 8, 2018, 12:55 a.m. UTC | #1
On Tue, May 08, 2018 at 09:05:51AM +1000, Dave Chinner wrote:
> 
> From: Dave Chinner <dchinner@redhat.com>
> 
> Fuzzing has recently uncovered a couple of conditions where we don't
> detect corruptions that reallocate already allocated inodes. This
> test exercises those cases, and checks that we shut down the
> filesystem appropriately when such a corruption occurs.
> 
> Signed-Off-By: Dave Chinner <dchinner@redhat.com>
> ---
> V2:
> - fix method of calling xfs_db to use correct helpers.
> 
>  tests/{shared/003 => xfs/450} | 41 ++++++++++++++++++++++-------------------
>  tests/xfs/450.out             | 26 ++++++++++++++++++++++++++
>  tests/xfs/group               |  1 +

Messed up with shared/003?

>  3 files changed, 49 insertions(+), 19 deletions(-)
> 
> diff --git a/tests/shared/003 b/tests/xfs/450
> similarity index 59%
> copy from tests/shared/003
> copy to tests/xfs/450
> index 9a9956cf44de..267089738574 100755
> --- a/tests/shared/003
> +++ b/tests/xfs/450
> @@ -1,15 +1,10 @@
>  #! /bin/bash
> -# FS QA Test 003
> +# FS QA Test 450
>  #
> -# Test mount a needs_recovery partition with noload option.
> -# ext4 used to Oops until part of this commit:
> -#
> -# 744692d ext4: use ext4_get_block_write in buffer write
> -#
> -# Also test on ext2/3.
> +# Catch inobt/on disk inode free state mismatches on V4 filesystems
>  #
>  #-----------------------------------------------------------------------
> -# Copyright (c) 2015 Red Hat Inc.  All Rights Reserved.
> +# Copyright (c) 2018 Red Hat, Inc.  All Rights Reserved.
>  #
>  # This program is free software; you can redistribute it and/or
>  # modify it under the terms of the GNU General Public License as
> @@ -45,25 +40,33 @@ _cleanup()
>  . ./common/rc
>  . ./common/filter
>  
> +# remove previous $seqres.full before test
> +rm -f $seqres.full
> +
>  # real QA test starts here
> -_supported_fs ext2 ext3 ext4
> +
> +_supported_fs xfs
>  _supported_os Linux
>  
> -# nofsck as we modify sb via debugfs
> +# we intentionally corrupt the filesystem, so don't check it after the test
>  _require_scratch_nocheck
>  
> -# remove previous $seqres.full before test
> -rm -f $seqres.full
> -echo "Silence is golden"
> +# on success, we'll get a shutdown filesystem with a really noisy log message
> +# due to transaction cancellation.  Hence we don't want to check dmesg here.
> +_disable_dmesg_check
> +
> +_require_xfs_mkfs_crc
> +_scratch_mkfs -m crc=0 > $seqres.full 2>&1

Looks like we can drop _require_xfs_mkfs_crc anyway, as
_scratch_mkfs_xfs will remove any metadata options if the mkfs.xfs
binary doesn't support it (done by _scratch_mkfs_xfs_opts).

Thanks,
Eryu

>  
> -_scratch_mkfs >>$seqres.full 2>&1
> +# corrupt an inode in the root inode chunk
> +root_ino=$(_scratch_xfs_get_metadata_field 'rootino' 'sb 0')
> +corrupt_ino=$((root_ino + 15))
> +_scratch_xfs_set_metadata_field 'core.mode' 0100644 "inode $corrupt_ino"
>  
> -# set needs_recovery feature bit
> -debugfs -w -R "feature +needs_recovery" $SCRATCH_DEV \
> -	>>$seqres.full 2>&1
> +_scratch_mount
>  
> -# mount with noload option
> -_try_scratch_mount "-o noload" >>$seqres.full 2>&1
> +# The corrupt inode should be tripped over during these initial file creates.
> +touch $SCRATCH_MNT/file{0,1,2,3,4,5}{0,1,2,3,4,5} 2>&1 | _filter_scratch
>  
>  # success, all done
>  status=0
> diff --git a/tests/xfs/450.out b/tests/xfs/450.out
> new file mode 100644
> index 000000000000..379a8d6f6ec9
> --- /dev/null
> +++ b/tests/xfs/450.out
> @@ -0,0 +1,26 @@
> +QA output created by 450
> +core.mode = 0100644
> +touch: cannot touch 'SCRATCH_MNT/file20': Structure needs cleaning
> +touch: cannot touch 'SCRATCH_MNT/file21': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file22': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file23': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file24': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file25': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file30': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file31': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file32': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file33': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file34': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file35': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file40': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file41': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file42': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file43': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file44': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file45': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file50': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file51': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file52': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file53': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file54': Input/output error
> +touch: cannot touch 'SCRATCH_MNT/file55': Input/output error
> diff --git a/tests/xfs/group b/tests/xfs/group
> index d62345fc8f96..2a7f5eb68e82 100644
> --- a/tests/xfs/group
> +++ b/tests/xfs/group
> @@ -442,3 +442,4 @@
>  443 auto quick ioctl fsr
>  444 auto quick
>  445 auto quick filestreams
> +450 auto quick
> --
> To unsubscribe from this list: send the line "unsubscribe fstests" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe fstests" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Dave Chinner May 10, 2018, 11:04 p.m. UTC | #2
On Tue, May 08, 2018 at 08:55:15AM +0800, Eryu Guan wrote:
> On Tue, May 08, 2018 at 09:05:51AM +1000, Dave Chinner wrote:
> > 
> > From: Dave Chinner <dchinner@redhat.com>
> > 
> > Fuzzing has recently uncovered a couple of conditions where we don't
> > detect corruptions that reallocate already allocated inodes. This
> > test exercises those cases, and checks that we shut down the
> > filesystem appropriately when such a corruption occurs.
> > 
> > Signed-Off-By: Dave Chinner <dchinner@redhat.com>
> > ---
> > V2:
> > - fix method of calling xfs_db to use correct helpers.
> > 
> >  tests/{shared/003 => xfs/450} | 41 ++++++++++++++++++++++-------------------
> >  tests/xfs/450.out             | 26 ++++++++++++++++++++++++++
> >  tests/xfs/group               |  1 +
> 
> Messed up with shared/003?

No. That's just git being smart with it's diffs:

> >  3 files changed, 49 insertions(+), 19 deletions(-)
> > 
> > diff --git a/tests/shared/003 b/tests/xfs/450
> > similarity index 59%
> > copy from tests/shared/003
> > copy to tests/xfs/450

It's copying and then patching, rather than just creating a whole
new file.


> > index 9a9956cf44de..267089738574 100755
> > --- a/tests/shared/003
> > +++ b/tests/xfs/450
> > @@ -1,15 +1,10 @@
> >  #! /bin/bash
> > -# FS QA Test 003
> > +# FS QA Test 450
> >  #
> > -# Test mount a needs_recovery partition with noload option.
> > -# ext4 used to Oops until part of this commit:
> > -#
> > -# 744692d ext4: use ext4_get_block_write in buffer write
> > -#
> > -# Also test on ext2/3.
> > +# Catch inobt/on disk inode free state mismatches on V4 filesystems
> >  #
> >  #-----------------------------------------------------------------------
> > -# Copyright (c) 2015 Red Hat Inc.  All Rights Reserved.
> > +# Copyright (c) 2018 Red Hat, Inc.  All Rights Reserved.
> >  #
> >  # This program is free software; you can redistribute it and/or
> >  # modify it under the terms of the GNU General Public License as
> > @@ -45,25 +40,33 @@ _cleanup()
> >  . ./common/rc
> >  . ./common/filter
> >  
> > +# remove previous $seqres.full before test
> > +rm -f $seqres.full
> > +
> >  # real QA test starts here
> > -_supported_fs ext2 ext3 ext4
> > +
> > +_supported_fs xfs
> >  _supported_os Linux
> >  
> > -# nofsck as we modify sb via debugfs
> > +# we intentionally corrupt the filesystem, so don't check it after the test
> >  _require_scratch_nocheck
> >  
> > -# remove previous $seqres.full before test
> > -rm -f $seqres.full
> > -echo "Silence is golden"
> > +# on success, we'll get a shutdown filesystem with a really noisy log message
> > +# due to transaction cancellation.  Hence we don't want to check dmesg here.
> > +_disable_dmesg_check
> > +
> > +_require_xfs_mkfs_crc
> > +_scratch_mkfs -m crc=0 > $seqres.full 2>&1
> 
> Looks like we can drop _require_xfs_mkfs_crc anyway, as
> _scratch_mkfs_xfs will remove any metadata options if the mkfs.xfs
> binary doesn't support it (done by _scratch_mkfs_xfs_opts).

/me wonders how _scratch_mkfs_xfs_opts() gets user mkfs parameters
passed to it to filter as _scratch_mkfs_xfs() doesn't pass any user
parameters to it....

Cheers,

Dave.
Eryu Guan May 11, 2018, 3:04 a.m. UTC | #3
On Fri, May 11, 2018 at 09:04:49AM +1000, Dave Chinner wrote:
> On Tue, May 08, 2018 at 08:55:15AM +0800, Eryu Guan wrote:
> > On Tue, May 08, 2018 at 09:05:51AM +1000, Dave Chinner wrote:
> > > 
> > > From: Dave Chinner <dchinner@redhat.com>
> > > 
> > > Fuzzing has recently uncovered a couple of conditions where we don't
> > > detect corruptions that reallocate already allocated inodes. This
> > > test exercises those cases, and checks that we shut down the
> > > filesystem appropriately when such a corruption occurs.
> > > 
> > > Signed-Off-By: Dave Chinner <dchinner@redhat.com>
> > > ---
> > > V2:
> > > - fix method of calling xfs_db to use correct helpers.
> > > 
> > >  tests/{shared/003 => xfs/450} | 41 ++++++++++++++++++++++-------------------
> > >  tests/xfs/450.out             | 26 ++++++++++++++++++++++++++
> > >  tests/xfs/group               |  1 +
> > 
> > Messed up with shared/003?
> 
> No. That's just git being smart with it's diffs:
> 
> > >  3 files changed, 49 insertions(+), 19 deletions(-)
> > > 
> > > diff --git a/tests/shared/003 b/tests/xfs/450
> > > similarity index 59%
> > > copy from tests/shared/003
> > > copy to tests/xfs/450
> 
> It's copying and then patching, rather than just creating a whole
> new file.

Ah, right.

> 
> 
> > > index 9a9956cf44de..267089738574 100755
> > > --- a/tests/shared/003
> > > +++ b/tests/xfs/450
> > > @@ -1,15 +1,10 @@
> > >  #! /bin/bash
> > > -# FS QA Test 003
> > > +# FS QA Test 450
> > >  #
> > > -# Test mount a needs_recovery partition with noload option.
> > > -# ext4 used to Oops until part of this commit:
> > > -#
> > > -# 744692d ext4: use ext4_get_block_write in buffer write
> > > -#
> > > -# Also test on ext2/3.
> > > +# Catch inobt/on disk inode free state mismatches on V4 filesystems
> > >  #
> > >  #-----------------------------------------------------------------------
> > > -# Copyright (c) 2015 Red Hat Inc.  All Rights Reserved.
> > > +# Copyright (c) 2018 Red Hat, Inc.  All Rights Reserved.
> > >  #
> > >  # This program is free software; you can redistribute it and/or
> > >  # modify it under the terms of the GNU General Public License as
> > > @@ -45,25 +40,33 @@ _cleanup()
> > >  . ./common/rc
> > >  . ./common/filter
> > >  
> > > +# remove previous $seqres.full before test
> > > +rm -f $seqres.full
> > > +
> > >  # real QA test starts here
> > > -_supported_fs ext2 ext3 ext4
> > > +
> > > +_supported_fs xfs
> > >  _supported_os Linux
> > >  
> > > -# nofsck as we modify sb via debugfs
> > > +# we intentionally corrupt the filesystem, so don't check it after the test
> > >  _require_scratch_nocheck
> > >  
> > > -# remove previous $seqres.full before test
> > > -rm -f $seqres.full
> > > -echo "Silence is golden"
> > > +# on success, we'll get a shutdown filesystem with a really noisy log message
> > > +# due to transaction cancellation.  Hence we don't want to check dmesg here.
> > > +_disable_dmesg_check
> > > +
> > > +_require_xfs_mkfs_crc
> > > +_scratch_mkfs -m crc=0 > $seqres.full 2>&1
> > 
> > Looks like we can drop _require_xfs_mkfs_crc anyway, as
> > _scratch_mkfs_xfs will remove any metadata options if the mkfs.xfs
> > binary doesn't support it (done by _scratch_mkfs_xfs_opts).
> 
> /me wonders how _scratch_mkfs_xfs_opts() gets user mkfs parameters
> passed to it to filter as _scratch_mkfs_xfs() doesn't pass any user
> parameters to it....

I turns out that I broke it in commit 596a068bf130 ("fstests: teach
_scratch_mkfs to handle mkfs option conflicts"), I forgot to pass extra
mkfs parameters to _scratch_mkfs_xfs_opts(). I'll send a fix soon.

Thanks,
Eryu

> 
> Cheers,
> 
> Dave.
> -- 
> Dave Chinner
> david@fromorbit.com
--
To unsubscribe from this list: send the line "unsubscribe fstests" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/tests/shared/003 b/tests/xfs/450
similarity index 59%
copy from tests/shared/003
copy to tests/xfs/450
index 9a9956cf44de..267089738574 100755
--- a/tests/shared/003
+++ b/tests/xfs/450
@@ -1,15 +1,10 @@ 
 #! /bin/bash
-# FS QA Test 003
+# FS QA Test 450
 #
-# Test mount a needs_recovery partition with noload option.
-# ext4 used to Oops until part of this commit:
-#
-# 744692d ext4: use ext4_get_block_write in buffer write
-#
-# Also test on ext2/3.
+# Catch inobt/on disk inode free state mismatches on V4 filesystems
 #
 #-----------------------------------------------------------------------
-# Copyright (c) 2015 Red Hat Inc.  All Rights Reserved.
+# Copyright (c) 2018 Red Hat, Inc.  All Rights Reserved.
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License as
@@ -45,25 +40,33 @@  _cleanup()
 . ./common/rc
 . ./common/filter
 
+# remove previous $seqres.full before test
+rm -f $seqres.full
+
 # real QA test starts here
-_supported_fs ext2 ext3 ext4
+
+_supported_fs xfs
 _supported_os Linux
 
-# nofsck as we modify sb via debugfs
+# we intentionally corrupt the filesystem, so don't check it after the test
 _require_scratch_nocheck
 
-# remove previous $seqres.full before test
-rm -f $seqres.full
-echo "Silence is golden"
+# on success, we'll get a shutdown filesystem with a really noisy log message
+# due to transaction cancellation.  Hence we don't want to check dmesg here.
+_disable_dmesg_check
+
+_require_xfs_mkfs_crc
+_scratch_mkfs -m crc=0 > $seqres.full 2>&1
 
-_scratch_mkfs >>$seqres.full 2>&1
+# corrupt an inode in the root inode chunk
+root_ino=$(_scratch_xfs_get_metadata_field 'rootino' 'sb 0')
+corrupt_ino=$((root_ino + 15))
+_scratch_xfs_set_metadata_field 'core.mode' 0100644 "inode $corrupt_ino"
 
-# set needs_recovery feature bit
-debugfs -w -R "feature +needs_recovery" $SCRATCH_DEV \
-	>>$seqres.full 2>&1
+_scratch_mount
 
-# mount with noload option
-_try_scratch_mount "-o noload" >>$seqres.full 2>&1
+# The corrupt inode should be tripped over during these initial file creates.
+touch $SCRATCH_MNT/file{0,1,2,3,4,5}{0,1,2,3,4,5} 2>&1 | _filter_scratch
 
 # success, all done
 status=0
diff --git a/tests/xfs/450.out b/tests/xfs/450.out
new file mode 100644
index 000000000000..379a8d6f6ec9
--- /dev/null
+++ b/tests/xfs/450.out
@@ -0,0 +1,26 @@ 
+QA output created by 450
+core.mode = 0100644
+touch: cannot touch 'SCRATCH_MNT/file20': Structure needs cleaning
+touch: cannot touch 'SCRATCH_MNT/file21': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file22': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file23': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file24': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file25': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file30': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file31': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file32': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file33': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file34': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file35': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file40': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file41': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file42': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file43': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file44': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file45': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file50': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file51': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file52': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file53': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file54': Input/output error
+touch: cannot touch 'SCRATCH_MNT/file55': Input/output error
diff --git a/tests/xfs/group b/tests/xfs/group
index d62345fc8f96..2a7f5eb68e82 100644
--- a/tests/xfs/group
+++ b/tests/xfs/group
@@ -442,3 +442,4 @@ 
 443 auto quick ioctl fsr
 444 auto quick
 445 auto quick filestreams
+450 auto quick