From patchwork Wed May 6 10:22:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amir Goldstein X-Patchwork-Id: 11530991 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D8C0114C0 for ; Wed, 6 May 2020 10:23:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C0AC9206DB for ; Wed, 6 May 2020 10:23:10 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Y3i/fAd5" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729013AbgEFKXK (ORCPT ); Wed, 6 May 2020 06:23:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1726354AbgEFKXK (ORCPT ); Wed, 6 May 2020 06:23:10 -0400 Received: from mail-wm1-x342.google.com (mail-wm1-x342.google.com [IPv6:2a00:1450:4864:20::342]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A93FC061A0F; Wed, 6 May 2020 03:23:08 -0700 (PDT) Received: by mail-wm1-x342.google.com with SMTP id g12so1993508wmh.3; Wed, 06 May 2020 03:23:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=VgsbU1olGZ3FSR/kBLu1xMOGeLhjZCKyfVl010oEcDc=; b=Y3i/fAd55EsDn5sFAQ/9LLgK5O7AJ3MBHxnGif8wYU7geioPhq4+vjxNhclawBXdK8 pJ3nkePcwgD3mmAwVuec18UNAjZwjsNwra/H19agrLIvbrVVq7S7tiGMFyId3uyo2Tvl 96PBafuYStwKyNZ8utajvRhLX0P5pv3MdBMZd0IEMT51p3cnh0Js2iMVMh8bBdZ/j1r0 8VL1XbUhHS+rbn/KuvJPMtqeyIGQoEd81evGG1mx/1K3WxudAeyvOF2vBjUBWKSRAEHO MvozmsKNJA4v+aLyqiniEgzvH+hTJ01Twu2J6GLVFJiDKiyjqNfagovBedyb/YLEDn76 2BSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=VgsbU1olGZ3FSR/kBLu1xMOGeLhjZCKyfVl010oEcDc=; b=LomMptHDam7tieRPHNlSO+EpZWi9I9MFgFNxd1+Ugaj2XIMUlUP5VC48PlWVSwCsJT Tog0K1RPHkC6EzRLS/xJQDxc1UFSRV10LUJ8/YVkJXDI5iYr5LynBtODb3/ht+IEXZzR ry5mLZ8G2/JQar46sIR0SNiOq2vu/QnmPFAVG+H/1DOfg0199cBrO36Bs0900hMax25b pTlNr/6WWwn0+6jQGD0qu9/iv6EaFE+ymBNZDWGwoITzPxOsBH8i/OrVidQBZYuuIHdK oJNhYKcrlc5ecJ0NG+9LL5Q2SX+NWnf0JlisyxnW3mcFExJQOE1pDdi9m4BLLONwAaUp /Z9g== X-Gm-Message-State: AGi0PuZa+1Tlr1ybJyfCoHY7FGF7jSNnTGkrOP0xMciNnhl+4Nk/GXXd d1bU+SDmpnyC6x4pLv0eAIg= X-Google-Smtp-Source: APiQypIfbp+7hc92uGJLLHkIR6176ZgAQVPwtfM/cp1y1VCEoYTmQAiBUbm7SOXtZIRIhbDn0Oe7Wg== X-Received: by 2002:a7b:c642:: with SMTP id q2mr3880650wmk.41.1588760587307; Wed, 06 May 2020 03:23:07 -0700 (PDT) Received: from localhost.localdomain ([141.226.12.123]) by smtp.gmail.com with ESMTPSA id u2sm2421379wrd.40.2020.05.06.03.23.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 06 May 2020 03:23:06 -0700 (PDT) From: Amir Goldstein To: Eryu Guan Cc: Miklos Szeredi , Lubos Dolezel , Dan Carpenter , linux-unionfs@vger.kernel.org, fstests@vger.kernel.org Subject: [PATCH 1/2] open_by_handle: add option -z to query file handle size Date: Wed, 6 May 2020 13:22:58 +0300 Message-Id: <20200506102259.28107-2-amir73il@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200506102259.28107-1-amir73il@gmail.com> References: <20200506102259.28107-1-amir73il@gmail.com> Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org Instead of using MAX_HANDLE_SZ, query the filesystem buffer size and use that buffer size to get the file handle. Signed-off-by: Amir Goldstein --- src/open_by_handle.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/src/open_by_handle.c b/src/open_by_handle.c index 4fdfacd7..0f74ed08 100644 --- a/src/open_by_handle.c +++ b/src/open_by_handle.c @@ -114,6 +114,7 @@ void usage(void) fprintf(stderr, "open_by_handle -i [N] - read test files handles from file and try to open by handle\n"); fprintf(stderr, "open_by_handle -o [N] - get file handles of test files and write handles to file\n"); fprintf(stderr, "open_by_handle -s [N] - wait in sleep loop after opening files by handle to keep them open\n"); + fprintf(stderr, "open_by_handle -z [N] - query filesystem required buffer size\n"); exit(EXIT_FAILURE); } @@ -136,11 +137,12 @@ int main(int argc, char **argv) int create = 0, delete = 0, nlink = 1, move = 0; int rd = 0, wr = 0, wrafter = 0, parent = 0; int keepopen = 0, drop_caches = 1, sleep_loop = 0; + int bufsz = MAX_HANDLE_SZ; if (argc < 2) usage(); - while ((c = getopt(argc, argv, "cludmrwapknhi:o:s")) != -1) { + while ((c = getopt(argc, argv, "cludmrwapknhi:o:sz")) != -1) { switch (c) { case 'c': create = 1; @@ -199,6 +201,9 @@ int main(int argc, char **argv) case 's': sleep_loop = 1; break; + case 'z': + bufsz = 0; + break; default: fprintf(stderr, "illegal option '%s'\n", argv[optind]); case 'h': @@ -300,8 +305,16 @@ int main(int argc, char **argv) return EXIT_FAILURE; } } else { - handle[i].fh.handle_bytes = MAX_HANDLE_SZ; + handle[i].fh.handle_bytes = bufsz; ret = name_to_handle_at(AT_FDCWD, fname, &handle[i].fh, &mount_id, 0); + if (bufsz < handle[i].fh.handle_bytes) { + /* Query the filesystem required bufsz and the file handle */ + if (ret != -1 || errno != EOVERFLOW) { + fprintf(stderr, "Unexpected result from name_to_handle_at(%s)\n", fname); + return EXIT_FAILURE; + } + ret = name_to_handle_at(AT_FDCWD, fname, &handle[i].fh, &mount_id, 0); + } if (ret < 0) { strcat(fname, ": name_to_handle"); perror(fname); @@ -334,8 +347,16 @@ int main(int argc, char **argv) return EXIT_FAILURE; } } else { - dir_handle.fh.handle_bytes = MAX_HANDLE_SZ; + dir_handle.fh.handle_bytes = bufsz; ret = name_to_handle_at(AT_FDCWD, test_dir, &dir_handle.fh, &mount_id, 0); + if (bufsz < dir_handle.fh.handle_bytes) { + /* Query the filesystem required bufsz and the file handle */ + if (ret != -1 || errno != EOVERFLOW) { + fprintf(stderr, "Unexpected result from name_to_handle_at(%s)\n", dname); + return EXIT_FAILURE; + } + ret = name_to_handle_at(AT_FDCWD, test_dir, &dir_handle.fh, &mount_id, 0); + } if (ret < 0) { strcat(dname, ": name_to_handle"); perror(dname); From patchwork Wed May 6 10:22:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amir Goldstein X-Patchwork-Id: 11530993 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7601F17EF for ; Wed, 6 May 2020 10:23:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5DF792068E for ; Wed, 6 May 2020 10:23:11 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nSwjVV/a" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729027AbgEFKXL (ORCPT ); Wed, 6 May 2020 06:23:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1726354AbgEFKXK (ORCPT ); Wed, 6 May 2020 06:23:10 -0400 Received: from mail-wr1-x443.google.com (mail-wr1-x443.google.com [IPv6:2a00:1450:4864:20::443]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3906AC061A10; Wed, 6 May 2020 03:23:10 -0700 (PDT) Received: by mail-wr1-x443.google.com with SMTP id h9so1556133wrt.0; Wed, 06 May 2020 03:23:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=drv/lQshwMz8JFGCjWSMSWEKkTBM8hi+ByQlYWp40hs=; b=nSwjVV/aXv1ZyEux69h0s4N/dMygvEi8LNiAvPcdo83hVmEn766fuq8IfMt5emxI6z 67MXWYXipFmC55wl5cjCnxn3LI8ib+l2uEEHDSGpJ94+G+ix5ldFcLqZ0YwMKgooOK2t hialsHMyt7JTwwcZqEGpQp6MTAVKwAAYvmR6P48NoAzLJgLCO9awR5egzcxJZ7eQXtWe /+iq+SUkOj9ajw/1e+GpNsgqArXgmiyicox4eCYAN0yBf7njmfDL1UNlEfZH5z32l6bC z/RG8R8Ovw01x2jg9BfJp0sSdo69WsoW0UNwG1wtMOLplGdbjuA3+5dP3m1nmdki/XYb VmmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=drv/lQshwMz8JFGCjWSMSWEKkTBM8hi+ByQlYWp40hs=; b=O/J7B1xQ216vP6yYYJvMWsNgfSiNTF4v+hchXyU7EyacxoYb5/zcrXYdDgDM9xcvsn 6kTm8xGp/UtKyL7lqDxwCtlsETwoI1ARF7bRgaGo6cy562p8DJ11Zu6f4mUxjrVOI7dI bIEGd9l9xQemsicmm/ob+Uijo4vcpCcoZ5ylmhjLFSc4BM1phNfQL7YmpfSTbVURMOuj Tuk6jV6hO33gX65j79RVD4H4+74tETfx1RVe1eRIHVQ1bwr+csm8+KjcJtY9z26g+0Qo xaNzLMkBiFf2FWTBZ7lOVpY1I0qzct0TvEdhrByPoOqVpJ+qghcLjrjDd1GwvkI9iryP j8Lw== X-Gm-Message-State: AGi0PuZ70oPnqYGSFQ7GkDQWtkDZkEAB+ZeZNx7q2zOO5Eq+94JtEaFK jEfN8qIs6kbMT29yGnCyB/Q= X-Google-Smtp-Source: APiQypL4WMshvTf8mO8fn2rPkHBdhvgg3je+vqQNo/6idAKMG6DIVSeWQ98O6MG3JMeRnrC0rlJMAw== X-Received: by 2002:adf:decb:: with SMTP id i11mr8103744wrn.172.1588760588946; Wed, 06 May 2020 03:23:08 -0700 (PDT) Received: from localhost.localdomain ([141.226.12.123]) by smtp.gmail.com with ESMTPSA id u2sm2421379wrd.40.2020.05.06.03.23.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 06 May 2020 03:23:08 -0700 (PDT) From: Amir Goldstein To: Eryu Guan Cc: Miklos Szeredi , Lubos Dolezel , Dan Carpenter , linux-unionfs@vger.kernel.org, fstests@vger.kernel.org Subject: [PATCH 2/2] overlay: regression test for two file handle bugs Date: Wed, 6 May 2020 13:22:59 +0300 Message-Id: <20200506102259.28107-3-amir73il@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200506102259.28107-1-amir73il@gmail.com> References: <20200506102259.28107-1-amir73il@gmail.com> Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org Test two overlayfs file handle bugs: 1. Failure to query file handle size Fixed by kernel commit: ovl: return required buffer size for file handles 2. Kernel OOPS on open by hand crafted malformed file handle Fixed by kernel commit: ovl: potential crash in ovl_fid_to_fh() Signed-off-by: Amir Goldstein --- tests/overlay/073 | 80 +++++++++++++++++++++++++++++++++++++++++++ tests/overlay/073.out | 2 ++ tests/overlay/group | 1 + 3 files changed, 83 insertions(+) create mode 100755 tests/overlay/073 create mode 100644 tests/overlay/073.out diff --git a/tests/overlay/073 b/tests/overlay/073 new file mode 100755 index 00000000..72233fae --- /dev/null +++ b/tests/overlay/073 @@ -0,0 +1,80 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) 2020 CTERA Networks. All Rights Reserved. +# +# FS QA Test No. 073 +# +# Test two overlayfs file handle bugs: +# 1. Failure to query file handle size +# Fixed by kernel commit: +# ovl: return required buffer size for file handles +# +# 2. Kernel OOPS on open by hand crafted malformed file handle +# Fixed by kernel commit: +# ovl: potential crash in ovl_fid_to_fh() +# +seq=`basename $0` +seqres=$RESULT_DIR/$seq +echo "QA output created by $seq" + +here=`pwd` +tmp=/tmp/$$ +status=1 # failure is the default! +trap "_cleanup; exit \$status" 0 1 2 3 15 + +_cleanup() +{ + cd / + #rm -f $tmp.* +} + +# get standard environment, filters and checks +. ./common/rc +. ./common/filter + +# real QA test starts here + +_supported_fs overlay +_supported_os Linux +_require_scratch +_require_test_program "open_by_handle" +# We need to require all features together, because nfs_export cannot +# be enabled when index is disabled +_require_scratch_overlay_features index nfs_export + +rm -f $seqres.full + +_scratch_mkfs +_scratch_mount -o "index=on,nfs_export=on" + +testdir=$SCRATCH_MNT/testdir + +# Create directory with test file +$here/src/open_by_handle -cp $testdir + +# Test query file handle size on dir and file +$here/src/open_by_handle -pz $testdir + +# Export file handle into tmp file +$here/src/open_by_handle -o $tmp.file_handle $testdir + +# Verify open by exported file handle +$here/src/open_by_handle -i $tmp.file_handle $testdir + +# Mangle the exported file handle: +# handle_bytes = 1 +# handle_type = OVL_FILEID_V0 (0xfb) +# File handle is encoded in host order +# The command below crafts this header for little endian. +# On different big endian architectures the file handle will still +# be malformed just not with the specific values to trigger the bug +$XFS_IO_PROG -c "pwrite -S 0 0 8" -c "pwrite -S 1 0 1" -c "pwrite -S 0xfb 4 1" $tmp.file_handle >> $seqres.full + +# Verify failure to open by mangled file handle +# This will trigger NULL pointer dereference on affected kernels +$here/src/open_by_handle -i $tmp.file_handle $testdir 2>> $seqres.full && \ + _fail "open by mangaled file handle is expected to fail" + +echo "Silence is golden" +status=0 +exit diff --git a/tests/overlay/073.out b/tests/overlay/073.out new file mode 100644 index 00000000..d107704c --- /dev/null +++ b/tests/overlay/073.out @@ -0,0 +1,2 @@ +QA output created by 073 +Silence is golden diff --git a/tests/overlay/group b/tests/overlay/group index 82876d09..5625a46d 100644 --- a/tests/overlay/group +++ b/tests/overlay/group @@ -75,3 +75,4 @@ 070 auto quick copyup redirect nested 071 auto quick copyup redirect nested nonsamefs 072 auto quick copyup hardlink +073 auto quick exportfs dangerous