All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Darrick J. Wong" <darrick.wong@oracle.com>
To: david@fromorbit.com, eguan@redhat.com, darrick.wong@oracle.com
Cc: linux-xfs@vger.kernel.org, fstests@vger.kernel.org
Subject: [PATCH v3 00/11] xfstests: online scrub/repair support
Date: Tue, 06 Dec 2016 16:18:11 -0800	[thread overview]
Message-ID: <148106989109.19334.6839386416313318071.stgit@birch.djwong.org> (raw)

Hi all,

This is the third revision of a patchset that adds to XFS userland
tools support for online metadata scrubbing and repair.

The first patch tests ocfs2's ability to handle reflink when there are
inline-data files.

The second patch maliciously corrupts ext4 and xfs filesystems to
exploit nonexistent checking of i_size in order to coerce Linux into
loading a file with negative size.  It then exploits integer overflows
in the VFS writeback code to hard lock the kernel.

** DO NOT RUN THESE TESTS UNLESS YOU HAVE APPLIED THIS PATCH: **
"vfs: reject inodes with negative size to prevent kernel hang"

---------------

The new patches in this series do three things: first, they expand the
filesystem populate commands inside xfstests to be able to create all
types of XFS metadata.  Second, they create a bunch of xfs_db wrapper
functions to iterate all fields present in a given metadata object and
fuzz them in various ways.  Finally, for each metadata object type there
is a separate test that iteratively fuzzes all fields of that object
and runs it through the mount/scrub/repair loop to see what happens.

If you're going to start using this mess, you probably ought to just
pull from my github trees for kernel[1], xfsprogs[2], and xfstests[3].
The kernel patches in the git trees should apply to 4.9-rc8; xfsprogs
patches to for-next; and xfstest to master.

The patches have survived all auto group xfstests both with scrub-only
mode and also a special debugging mode to xfs_scrub that forces it to
rebuild the metadata structures even if they're not damaged.  Note that
I haven't thoroughly run the new tests in [3] that try to fuzz every
field in every data structure on disk.

This is an extraordinary way to eat your data.  Enjoy! 
Comments and questions are, as always, welcome.

--D

[1] https://github.com/djwong/linux/tree/djwong-devel
[2] https://github.com/djwong/xfsprogs/tree/djwong-devel
[3] https://github.com/djwong/xfstests/tree/djwong-devel

             reply	other threads:[~2016-12-07  0:18 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-12-07  0:18 Darrick J. Wong [this message]
2016-12-07  0:18 ` [PATCH 01/11] ocfs2: test reflinking to inline data files Darrick J. Wong
2016-12-07  0:18 ` [PATCH 02/11] xfs/ext4: check negative inode size Darrick J. Wong
2016-12-07  0:18 ` [PATCH 03/11] populate: create all types of XFS metadata Darrick J. Wong
2016-12-07  0:18 ` [PATCH 04/11] populate: add _require_populate_commands to check for tools Darrick J. Wong
2016-12-07  0:18 ` [PATCH 05/11] populate: optionally fill the filesystem when populating fs Darrick J. Wong
2016-12-07  0:18 ` [PATCH 06/11] populate: fix some silly errors when modifying a fs while fuzzing Darrick J. Wong
2016-12-07  0:18 ` [PATCH 07/11] common/fuzzy: move fuzzing helper functions here Darrick J. Wong
2016-12-07  0:19 ` [PATCH 08/11] populate: cache scratch metadata images Darrick J. Wong
2016-12-07  0:19 ` [PATCH 09/11] populate: discover XFS structure fields and fuzz verbs, and use them to fuzz fields Darrick J. Wong
2016-12-07  0:19 ` [PATCH 10/11] common/populate: create attrs in different namespaces Darrick J. Wong
2016-12-07  0:19 ` [PATCH 11/11] xfs: fuzz every field of every structure Darrick J. Wong

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=148106989109.19334.6839386416313318071.stgit@birch.djwong.org \
    --to=darrick.wong@oracle.com \
    --cc=david@fromorbit.com \
    --cc=eguan@redhat.com \
    --cc=fstests@vger.kernel.org \
    --cc=linux-xfs@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.