[PATCH 0/4] fstests: fixes and new tests

[PATCH 0/4] fstests: fixes and new tests

[Darrick J. Wong]

Hi all,

The first patch fixes xfs/365 to fuzz the AG1 inobt since as of 4.18 XFS
requires an intact AG0 inobt even to mount.

The second patch provides a regression test for "xfs: fix fdblocks
accounting w/ RMAPBT per-AG reservation".

The third patch provides a regression test for a condition where mmap
read of a file's EOF page shows nonzero bytes after EOF if the
previous operation was a zero_range all the way to EOF.  This bug only
seems to manifest on XFS, but it uses generic APIs and so is a generic
test.  The patch concerned here is "xfs: ensure post-EOF zeroing happens
after zeroing part of a file".

The fourth patch adds a variant to the xfs fuzz tests where we fuzz the
metadata fields and immediately try to write to the filesystem.

--D

[PATCH 1/4] xfs/365: fuzz inobt in ag 1

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

In kernel patch "xfs: verify root inode more thoroughly", we strengthen
the root inode mount checks to make sure that the inobt agrees that the
root inode exists and is in use.  Unfortunately, that makes this whole
test useless because we can't even mount the filesystem to run scrub.
So, redirect it to AG1's inobt.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 tests/xfs/365 |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


diff --git a/tests/xfs/365 b/tests/xfs/365
index 64e910ed..bd29b2a3 100755
--- a/tests/xfs/365
+++ b/tests/xfs/365
@@ -37,7 +37,7 @@ echo "Format and populate"
 _scratch_populate_cached nofill > $seqres.full 2>&1
 
 echo "Fuzz inobt"
-_scratch_xfs_fuzz_metadata '' 'online'  'agi 0' 'addr root' >> $seqres.full
+_scratch_xfs_fuzz_metadata '' 'online'  'agi 1' 'addr root' >> $seqres.full
 echo "Done fuzzing inobt"
 
 # success, all done

[PATCH 2/4] xfs: regression test for rmapbt fdblocks accounting problems

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

In "xfs: fix fdblocks accounting w/ RMAPBT per-AG reservation", we fixed
the per-ag reservation code so that we always decrease fdblocks by the
reserved size because rmapbt blocks are counted as free space.

The primary symptom of this bug is that if the rmapbt has expanded since
mount time, the disk block counters reported via statfs will change
across a remount.  Therefore, we exercise this as a regression test.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 tests/xfs/712     |   62 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/712.out |    1 +
 tests/xfs/group   |    1 +
 3 files changed, 64 insertions(+)
 create mode 100755 tests/xfs/712
 create mode 100644 tests/xfs/712.out


diff --git a/tests/xfs/712 b/tests/xfs/712
new file mode 100755
index 00000000..f90c7ec9
--- /dev/null
+++ b/tests/xfs/712
@@ -0,0 +1,62 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 712
+#
+# Make sure that the statfs b_avail counter doesn't change across remount
+# after the rmapbt has grown in size.
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+
+# remove previous \$seqres.full before test
+rm -f $seqres.full
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_test_program "punch-alternating"
+_require_xfs_scratch_rmapbt
+
+_scratch_mkfs >> $seqres.full
+_scratch_mount
+
+# Make sure we allocate a big enough file such that punching out every other
+# block will cause the rmapbt to expand by at least one block.
+blksz=$(_get_file_block_size $SCRATCH_MNT)
+nr_rmap_per_rmapbt=$(( (blksz - 56) / 24))
+blks=$(( (nr_rmap_per_rmapbt + 2) * 2))
+$XFS_IO_PROG -f -c "falloc 0 $((blks * blksz))" $SCRATCH_MNT/a >> $seqres.full
+./src/punch-alternating $SCRATCH_MNT/a
+
+# Do the stat counters change across the remount?
+before=$(stat -f -c '%b %f' $SCRATCH_MNT)
+_scratch_cycle_mount
+after=$(stat -f -c '%b %f' $SCRATCH_MNT)
+
+if [ "${before}" != "${after}" ]; then
+	echo "counters changed: ${before} ${after}"
+	echo "before: ${before}" >> $seqres.full
+	echo "after: ${after}" >> $seqres.full
+fi
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/712.out b/tests/xfs/712.out
new file mode 100644
index 00000000..4e900419
--- /dev/null
+++ b/tests/xfs/712.out
@@ -0,0 +1 @@
+QA output created by 712
diff --git a/tests/xfs/group b/tests/xfs/group
index 932ab909..2f1c8467 100644
--- a/tests/xfs/group
+++ b/tests/xfs/group
@@ -447,3 +447,4 @@
 447 auto mount
 448 auto quick fuzzers
 449 auto quick
+712 auto quick rmap

[PATCH 3/4] generic: mread past eof shows nonzero contents

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

Certain sequences of generic/127 invocations complain about being able
to mread nonzero contents past eof.  Replicate that here as a regression
test.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 tests/generic/708     |   54 +++++++++++++++++++++++++++++++++++++++++++++++++
 tests/generic/708.out |    2 ++
 tests/generic/group   |    1 +
 3 files changed, 57 insertions(+)
 create mode 100755 tests/generic/708
 create mode 100644 tests/generic/708.out


diff --git a/tests/generic/708 b/tests/generic/708
new file mode 100755
index 00000000..d380053f
--- /dev/null
+++ b/tests/generic/708
@@ -0,0 +1,54 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All Rights Reserved.
+#
+# FS QA Test No. 708
+#
+# Test a specific sequence of fsx operations that causes an mmap read past
+# eof to return nonzero contents.
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+
+# real QA test starts here
+_supported_fs generic
+_supported_os Linux
+_require_scratch
+
+rm -f $seqres.full
+
+_scratch_mkfs >>$seqres.full 2>&1
+_scratch_mount
+
+cat >> $tmp.fsxops << ENDL
+fallocate 0x77e2 0x5f06 0x269a2 keep_size
+mapwrite 0x2e7fc 0x42ba 0x3f989
+write 0x67a9 0x714e 0x3f989
+write 0x39f96 0x185a 0x3f989
+collapse_range 0x36000 0x8000 0x3f989
+mapread 0x74c0 0x1bb3 0x3e2d0
+truncate 0x0 0x8aa2 0x3e2d0
+zero_range 0x1265 0x783d 0x8aa2
+mapread 0x7bd8 0xeca 0x8aa2
+ENDL
+
+victim=$SCRATCH_MNT/a
+touch $victim
+$here/ltp/fsx --replay-ops $tmp.fsxops $victim > $tmp.output || cat $tmp.output
+
+echo "Silence is golden"
+status=0
+exit
diff --git a/tests/generic/708.out b/tests/generic/708.out
new file mode 100644
index 00000000..33c478ad
--- /dev/null
+++ b/tests/generic/708.out
@@ -0,0 +1,2 @@
+QA output created by 708
+Silence is golden
diff --git a/tests/generic/group b/tests/generic/group
index 83a6fdab..1a1a0a6e 100644
--- a/tests/generic/group
+++ b/tests/generic/group
@@ -501,3 +501,4 @@
 496 auto quick swap
 497 auto quick swap collapse
 498 auto quick log
+708 auto quick rw collapse

[PATCH 4/4] xfs: fuzz every field of every structure and test kernel crashes

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

Fuzz every field of every structure and then try to write the
filesystem, to see how many of these writes can crash the kernel.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 common/fuzzy       |   42 ++++++++++++++++++++++++------------------
 tests/xfs/1387     |   45 +++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1387.out |    4 ++++
 tests/xfs/1388     |   45 +++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1388.out |    4 ++++
 tests/xfs/1389     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1389.out |    6 ++++++
 tests/xfs/1390     |   45 +++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1390.out |    4 ++++
 tests/xfs/1391     |   45 +++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1391.out |    4 ++++
 tests/xfs/1392     |   45 +++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1392.out |    4 ++++
 tests/xfs/1393     |   45 +++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1393.out |    4 ++++
 tests/xfs/1394     |   45 +++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1394.out |    4 ++++
 tests/xfs/1395     |   46 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1395.out |    4 ++++
 tests/xfs/1396     |   46 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1396.out |    4 ++++
 tests/xfs/1397     |   46 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1397.out |    4 ++++
 tests/xfs/1398     |   47 +++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1398.out |    4 ++++
 tests/xfs/1399     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1399.out |    5 +++++
 tests/xfs/1400     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1400.out |    5 +++++
 tests/xfs/1401     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1401.out |    5 +++++
 tests/xfs/1402     |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1402.out |    5 +++++
 tests/xfs/1403     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1403.out |    5 +++++
 tests/xfs/1404     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1404.out |    5 +++++
 tests/xfs/1405     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1405.out |    5 +++++
 tests/xfs/1406     |   51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1406.out |    5 +++++
 tests/xfs/1407     |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1407.out |    5 +++++
 tests/xfs/1408     |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1408.out |    5 +++++
 tests/xfs/1409     |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1409.out |    5 +++++
 tests/xfs/1410     |   52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1410.out |    5 +++++
 tests/xfs/1411     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1411.out |    5 +++++
 tests/xfs/1412     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1412.out |    5 +++++
 tests/xfs/1413     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1413.out |    5 +++++
 tests/xfs/1414     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1414.out |    5 +++++
 tests/xfs/1415     |   49 +++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1415.out |    4 ++++
 tests/xfs/1416     |   47 +++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1416.out |    4 ++++
 tests/xfs/1417     |   47 +++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1417.out |    4 ++++
 tests/xfs/1418     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1418.out |    5 +++++
 tests/xfs/1419     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1419.out |    5 +++++
 tests/xfs/1420     |   50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1420.out |    5 +++++
 tests/xfs/1421     |   48 ++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1421.out |    4 ++++
 tests/xfs/1422     |   48 ++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1422.out |    4 ++++
 tests/xfs/1423     |   48 ++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/1423.out |    4 ++++
 tests/xfs/group    |   37 +++++++++++++++++++++++++++++++++++++
 76 files changed, 2028 insertions(+), 18 deletions(-)
 create mode 100755 tests/xfs/1387
 create mode 100644 tests/xfs/1387.out
 create mode 100755 tests/xfs/1388
 create mode 100644 tests/xfs/1388.out
 create mode 100755 tests/xfs/1389
 create mode 100644 tests/xfs/1389.out
 create mode 100755 tests/xfs/1390
 create mode 100644 tests/xfs/1390.out
 create mode 100755 tests/xfs/1391
 create mode 100644 tests/xfs/1391.out
 create mode 100755 tests/xfs/1392
 create mode 100644 tests/xfs/1392.out
 create mode 100755 tests/xfs/1393
 create mode 100644 tests/xfs/1393.out
 create mode 100755 tests/xfs/1394
 create mode 100644 tests/xfs/1394.out
 create mode 100755 tests/xfs/1395
 create mode 100644 tests/xfs/1395.out
 create mode 100755 tests/xfs/1396
 create mode 100644 tests/xfs/1396.out
 create mode 100755 tests/xfs/1397
 create mode 100644 tests/xfs/1397.out
 create mode 100755 tests/xfs/1398
 create mode 100644 tests/xfs/1398.out
 create mode 100755 tests/xfs/1399
 create mode 100644 tests/xfs/1399.out
 create mode 100755 tests/xfs/1400
 create mode 100644 tests/xfs/1400.out
 create mode 100755 tests/xfs/1401
 create mode 100644 tests/xfs/1401.out
 create mode 100755 tests/xfs/1402
 create mode 100644 tests/xfs/1402.out
 create mode 100755 tests/xfs/1403
 create mode 100644 tests/xfs/1403.out
 create mode 100755 tests/xfs/1404
 create mode 100644 tests/xfs/1404.out
 create mode 100755 tests/xfs/1405
 create mode 100644 tests/xfs/1405.out
 create mode 100755 tests/xfs/1406
 create mode 100644 tests/xfs/1406.out
 create mode 100755 tests/xfs/1407
 create mode 100644 tests/xfs/1407.out
 create mode 100755 tests/xfs/1408
 create mode 100644 tests/xfs/1408.out
 create mode 100755 tests/xfs/1409
 create mode 100644 tests/xfs/1409.out
 create mode 100755 tests/xfs/1410
 create mode 100644 tests/xfs/1410.out
 create mode 100755 tests/xfs/1411
 create mode 100644 tests/xfs/1411.out
 create mode 100755 tests/xfs/1412
 create mode 100644 tests/xfs/1412.out
 create mode 100755 tests/xfs/1413
 create mode 100644 tests/xfs/1413.out
 create mode 100755 tests/xfs/1414
 create mode 100644 tests/xfs/1414.out
 create mode 100755 tests/xfs/1415
 create mode 100644 tests/xfs/1415.out
 create mode 100755 tests/xfs/1416
 create mode 100644 tests/xfs/1416.out
 create mode 100755 tests/xfs/1417
 create mode 100644 tests/xfs/1417.out
 create mode 100755 tests/xfs/1418
 create mode 100644 tests/xfs/1418.out
 create mode 100755 tests/xfs/1419
 create mode 100644 tests/xfs/1419.out
 create mode 100755 tests/xfs/1420
 create mode 100644 tests/xfs/1420.out
 create mode 100755 tests/xfs/1421
 create mode 100644 tests/xfs/1421.out
 create mode 100755 tests/xfs/1422
 create mode 100644 tests/xfs/1422.out
 create mode 100755 tests/xfs/1423
 create mode 100644 tests/xfs/1423.out


diff --git a/common/fuzzy b/common/fuzzy
index 025f2615..5f46d4fb 100644
--- a/common/fuzzy
+++ b/common/fuzzy
@@ -169,7 +169,7 @@ __fuzz_notify() {
 # Fuzz one field of some piece of metadata.
 # First arg is the field name
 # Second arg is the fuzz verb (ones, zeroes, random, add, sub...)
-# Third arg is the repair mode (online, offline, both)
+# Third arg is the repair mode (online, offline, both, none)
 __scratch_xfs_fuzz_field_test() {
 	field="$1"
 	fuzzverb="$2"
@@ -190,12 +190,14 @@ __scratch_xfs_fuzz_field_test() {
 	if [ $res -eq 0 ]; then
 		# Try an online scrub unless we're fuzzing ag 0's sb,
 		# which scrub doesn't know how to fix.
-		echo "++ Online scrub"
-		if [ "$1" != "sb 0" ]; then
-			_scratch_scrub -n -a 1 -e continue 2>&1
-			res=$?
-			test $res -eq 0 && \
-				(>&2 echo "scrub didn't fail with ${field} = ${fuzzverb}.")
+		if [ "${repair}" != "none" ]; then
+			echo "++ Online scrub"
+			if [ "$1" != "sb 0" ]; then
+				_scratch_scrub -n -a 1 -e continue 2>&1
+				res=$?
+				test $res -eq 0 && \
+					(>&2 echo "scrub didn't fail with ${field} = ${fuzzverb}.")
+			fi
 		fi
 
 		# Try fixing the filesystem online?!
@@ -222,11 +224,13 @@ __scratch_xfs_fuzz_field_test() {
 	fi
 
 	# See if repair finds a clean fs
-	echo "+ Make sure error is gone (offline)"
-        _scratch_xfs_repair -n 2>&1
-	res=$?
-	test $res -ne 0 && \
-		(>&2 echo "offline re-scrub ($res) with ${field} = ${fuzzverb}.")
+	if [ "${repair}" != "none" ]; then
+		echo "+ Make sure error is gone (offline)"
+		_scratch_xfs_repair -n 2>&1
+		res=$?
+		test $res -ne 0 && \
+			(>&2 echo "offline re-scrub ($res) with ${field} = ${fuzzverb}.")
+	fi
 
 	# See if scrub finds a clean fs
 	echo "+ Make sure error is gone (online)"
@@ -235,12 +239,14 @@ __scratch_xfs_fuzz_field_test() {
 	if [ $res -eq 0 ]; then
 		# Try an online scrub unless we're fuzzing ag 0's sb,
 		# which scrub doesn't know how to fix.
-		echo "++ Online scrub"
-		if [ "$1" != "sb 0" ]; then
-			_scratch_scrub -n -e continue 2>&1
-			res=$?
-			test $res -ne 0 && \
-				(>&2 echo "online re-scrub ($res) with ${field} = ${fuzzverb}.")
+		if [ "${repair}" != "none" ]; then
+			echo "++ Online scrub"
+			if [ "$1" != "sb 0" ]; then
+				_scratch_scrub -n -e continue 2>&1
+				res=$?
+				test $res -ne 0 && \
+					(>&2 echo "online re-scrub ($res) with ${field} = ${fuzzverb}.")
+			fi
 		fi
 
 		# Try modifying the filesystem again!
diff --git a/tests/xfs/1387 b/tests/xfs/1387
new file mode 100755
index 00000000..6e7c3ec4
--- /dev/null
+++ b/tests/xfs/1387
@@ -0,0 +1,45 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1387
+#
+# Populate a XFS filesystem and fuzz every superblock field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz superblock"
+_scratch_xfs_fuzz_metadata '' 'none' 'sb 1' >> $seqres.full
+echo "Done fuzzing superblock"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1387.out b/tests/xfs/1387.out
new file mode 100644
index 00000000..67adab71
--- /dev/null
+++ b/tests/xfs/1387.out
@@ -0,0 +1,4 @@
+QA output created by 1387
+Format and populate
+Fuzz superblock
+Done fuzzing superblock
diff --git a/tests/xfs/1388 b/tests/xfs/1388
new file mode 100755
index 00000000..dab00852
--- /dev/null
+++ b/tests/xfs/1388
@@ -0,0 +1,45 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1388
+#
+# Populate a XFS filesystem and fuzz every AGF field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz AGF"
+_scratch_xfs_fuzz_metadata '' 'none' 'agf 0' >> $seqres.full
+echo "Done fuzzing AGF"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1388.out b/tests/xfs/1388.out
new file mode 100644
index 00000000..5b3b8077
--- /dev/null
+++ b/tests/xfs/1388.out
@@ -0,0 +1,4 @@
+QA output created by 1388
+Format and populate
+Fuzz AGF
+Done fuzzing AGF
diff --git a/tests/xfs/1389 b/tests/xfs/1389
new file mode 100755
index 00000000..2c4c79b1
--- /dev/null
+++ b/tests/xfs/1389
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1389
+#
+# Populate a XFS filesystem and fuzz every AGFL field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz AGFL"
+_scratch_xfs_fuzz_metadata '' 'none' 'agfl 0' >> $seqres.full
+echo "Done fuzzing AGFL"
+
+echo "Fuzz AGFL flfirst"
+flfirst=$(_scratch_xfs_db -c 'agf 0' -c 'p flfirst' | sed -e 's/flfirst = //g')
+SCRATCH_XFS_LIST_METADATA_FIELDS="bno[${flfirst}]" _scratch_xfs_fuzz_metadata '' 'none' 'agfl 0' >> $seqres.full
+echo "Done fuzzing AGFL flfirst"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1389.out b/tests/xfs/1389.out
new file mode 100644
index 00000000..7f7db14c
--- /dev/null
+++ b/tests/xfs/1389.out
@@ -0,0 +1,6 @@
+QA output created by 1389
+Format and populate
+Fuzz AGFL
+Done fuzzing AGFL
+Fuzz AGFL flfirst
+Done fuzzing AGFL flfirst
diff --git a/tests/xfs/1390 b/tests/xfs/1390
new file mode 100755
index 00000000..2d22d5df
--- /dev/null
+++ b/tests/xfs/1390
@@ -0,0 +1,45 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1390
+#
+# Populate a XFS filesystem and fuzz every AGI field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz AGI"
+_scratch_xfs_fuzz_metadata '' 'none' 'agi 0' >> $seqres.full
+echo "Done fuzzing AGI"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1390.out b/tests/xfs/1390.out
new file mode 100644
index 00000000..0119f32b
--- /dev/null
+++ b/tests/xfs/1390.out
@@ -0,0 +1,4 @@
+QA output created by 1390
+Format and populate
+Fuzz AGI
+Done fuzzing AGI
diff --git a/tests/xfs/1391 b/tests/xfs/1391
new file mode 100755
index 00000000..8ae90e0c
--- /dev/null
+++ b/tests/xfs/1391
@@ -0,0 +1,45 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1391
+#
+# Populate a XFS filesystem and fuzz every bnobt field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz bnobt recs"
+_scratch_xfs_fuzz_metadata '' 'none'  'agf 0' 'addr bnoroot' 'addr ptrs[1]' >> $seqres.full
+echo "Done fuzzing bnobt recs"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1391.out b/tests/xfs/1391.out
new file mode 100644
index 00000000..382b0902
--- /dev/null
+++ b/tests/xfs/1391.out
@@ -0,0 +1,4 @@
+QA output created by 1391
+Format and populate
+Fuzz bnobt recs
+Done fuzzing bnobt recs
diff --git a/tests/xfs/1392 b/tests/xfs/1392
new file mode 100755
index 00000000..1b3e6fd4
--- /dev/null
+++ b/tests/xfs/1392
@@ -0,0 +1,45 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1392
+#
+# Populate a XFS filesystem and fuzz every bnobt key/pointer.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz bnobt keyptr"
+_scratch_xfs_fuzz_metadata '' 'none'  'agf 0' 'addr bnoroot' >> $seqres.full
+echo "Done fuzzing bnobt keyptr"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1392.out b/tests/xfs/1392.out
new file mode 100644
index 00000000..e7b9c660
--- /dev/null
+++ b/tests/xfs/1392.out
@@ -0,0 +1,4 @@
+QA output created by 1392
+Format and populate
+Fuzz bnobt keyptr
+Done fuzzing bnobt keyptr
diff --git a/tests/xfs/1393 b/tests/xfs/1393
new file mode 100755
index 00000000..d1f87f0d
--- /dev/null
+++ b/tests/xfs/1393
@@ -0,0 +1,45 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1393
+#
+# Populate a XFS filesystem and fuzz every cntbt field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz cntbt"
+_scratch_xfs_fuzz_metadata '' 'none'  'agf 0' 'addr cntroot' 'addr ptrs[1]' >> $seqres.full
+echo "Done fuzzing cntbt"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1393.out b/tests/xfs/1393.out
new file mode 100644
index 00000000..d63c8ca9
--- /dev/null
+++ b/tests/xfs/1393.out
@@ -0,0 +1,4 @@
+QA output created by 1393
+Format and populate
+Fuzz cntbt
+Done fuzzing cntbt
diff --git a/tests/xfs/1394 b/tests/xfs/1394
new file mode 100755
index 00000000..e95627cd
--- /dev/null
+++ b/tests/xfs/1394
@@ -0,0 +1,45 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1394
+#
+# Populate a XFS filesystem and fuzz every inobt field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz inobt"
+_scratch_xfs_fuzz_metadata '' 'none'  'agi 1' 'addr root' >> $seqres.full
+echo "Done fuzzing inobt"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1394.out b/tests/xfs/1394.out
new file mode 100644
index 00000000..83277856
--- /dev/null
+++ b/tests/xfs/1394.out
@@ -0,0 +1,4 @@
+QA output created by 1394
+Format and populate
+Fuzz inobt
+Done fuzzing inobt
diff --git a/tests/xfs/1395 b/tests/xfs/1395
new file mode 100755
index 00000000..3d828740
--- /dev/null
+++ b/tests/xfs/1395
@@ -0,0 +1,46 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1395
+#
+# Populate a XFS filesystem and fuzz every finobt field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+_require_xfs_finobt
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz finobt"
+_scratch_xfs_fuzz_metadata '' 'none'  'agi 0' 'addr free_root' >> $seqres.full
+echo "Done fuzzing finobt"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1395.out b/tests/xfs/1395.out
new file mode 100644
index 00000000..408f894b
--- /dev/null
+++ b/tests/xfs/1395.out
@@ -0,0 +1,4 @@
+QA output created by 1395
+Format and populate
+Fuzz finobt
+Done fuzzing finobt
diff --git a/tests/xfs/1396 b/tests/xfs/1396
new file mode 100755
index 00000000..09504c0a
--- /dev/null
+++ b/tests/xfs/1396
@@ -0,0 +1,46 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1396
+#
+# Populate a XFS filesystem and fuzz every rmapbt field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_xfs_scratch_rmapbt
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz rmapbt recs"
+_scratch_xfs_fuzz_metadata '' 'none' 'agf 0' 'addr rmaproot' 'addr ptrs[1]' >> $seqres.full
+echo "Done fuzzing rmapbt recs"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1396.out b/tests/xfs/1396.out
new file mode 100644
index 00000000..ee974659
--- /dev/null
+++ b/tests/xfs/1396.out
@@ -0,0 +1,4 @@
+QA output created by 1396
+Format and populate
+Fuzz rmapbt recs
+Done fuzzing rmapbt recs
diff --git a/tests/xfs/1397 b/tests/xfs/1397
new file mode 100755
index 00000000..23f4cc3e
--- /dev/null
+++ b/tests/xfs/1397
@@ -0,0 +1,46 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1397
+#
+# Populate a XFS filesystem and fuzz every rmapbt key/pointer field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_xfs_scratch_rmapbt
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz rmapbt keyptr"
+_scratch_xfs_fuzz_metadata '' 'none' 'agf 0' 'addr rmaproot' >> $seqres.full
+echo "Done fuzzing rmapbt keyptr"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1397.out b/tests/xfs/1397.out
new file mode 100644
index 00000000..01258bbe
--- /dev/null
+++ b/tests/xfs/1397.out
@@ -0,0 +1,4 @@
+QA output created by 1397
+Format and populate
+Fuzz rmapbt keyptr
+Done fuzzing rmapbt keyptr
diff --git a/tests/xfs/1398 b/tests/xfs/1398
new file mode 100755
index 00000000..fbd9d454
--- /dev/null
+++ b/tests/xfs/1398
@@ -0,0 +1,47 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1398
+#
+# Populate a XFS filesystem and fuzz every refcountbt field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+. ./common/reflink
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_reflink
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz refcountbt"
+_scratch_xfs_fuzz_metadata '' 'none'  'agf 0' 'addr refcntroot' >> $seqres.full
+echo "Done fuzzing refcountbt"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1398.out b/tests/xfs/1398.out
new file mode 100644
index 00000000..ab572804
--- /dev/null
+++ b/tests/xfs/1398.out
@@ -0,0 +1,4 @@
+QA output created by 1398
+Format and populate
+Fuzz refcountbt
+Done fuzzing refcountbt
diff --git a/tests/xfs/1399 b/tests/xfs/1399
new file mode 100755
index 00000000..9c3c7849
--- /dev/null
+++ b/tests/xfs/1399
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1399
+#
+# Populate a XFS filesystem and fuzz every btree-format directory inode field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find btree-format dir inode"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFDIR.FMT_BTREE)
+_scratch_unmount
+
+echo "Fuzz inode"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" >> $seqres.full
+echo "Done fuzzing inode"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1399.out b/tests/xfs/1399.out
new file mode 100644
index 00000000..f57a3648
--- /dev/null
+++ b/tests/xfs/1399.out
@@ -0,0 +1,5 @@
+QA output created by 1399
+Format and populate
+Find btree-format dir inode
+Fuzz inode
+Done fuzzing inode
diff --git a/tests/xfs/1400 b/tests/xfs/1400
new file mode 100755
index 00000000..99baf6f9
--- /dev/null
+++ b/tests/xfs/1400
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1400
+#
+# Populate a XFS filesystem and fuzz every extents-format file inode field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find extents-format file inode"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFREG.FMT_EXTENTS)
+_scratch_unmount
+
+echo "Fuzz inode"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" >> $seqres.full
+echo "Done fuzzing inode"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1400.out b/tests/xfs/1400.out
new file mode 100644
index 00000000..5415c8d6
--- /dev/null
+++ b/tests/xfs/1400.out
@@ -0,0 +1,5 @@
+QA output created by 1400
+Format and populate
+Find extents-format file inode
+Fuzz inode
+Done fuzzing inode
diff --git a/tests/xfs/1401 b/tests/xfs/1401
new file mode 100755
index 00000000..eea55ae4
--- /dev/null
+++ b/tests/xfs/1401
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1401
+#
+# Populate a XFS filesystem and fuzz every btree-format file inode field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find btree-format file inode"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFREG.FMT_BTREE)
+_scratch_unmount
+
+echo "Fuzz inode"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" >> $seqres.full
+echo "Done fuzzing inode"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1401.out b/tests/xfs/1401.out
new file mode 100644
index 00000000..6dbf00f0
--- /dev/null
+++ b/tests/xfs/1401.out
@@ -0,0 +1,5 @@
+QA output created by 1401
+Format and populate
+Find btree-format file inode
+Fuzz inode
+Done fuzzing inode
diff --git a/tests/xfs/1402 b/tests/xfs/1402
new file mode 100755
index 00000000..53bf64e7
--- /dev/null
+++ b/tests/xfs/1402
@@ -0,0 +1,52 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1402
+#
+# Populate a XFS filesystem and fuzz every bmbt block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find bmbt block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFREG.FMT_BTREE)
+_scratch_unmount
+
+inode_ver=$(_scratch_xfs_get_metadata_field "core.version" "inode ${inum}")
+
+echo "Fuzz bmbt"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" "addr u${inode_ver}.bmbt.ptrs[1]" >> $seqres.full
+echo "Done fuzzing bmbt"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1402.out b/tests/xfs/1402.out
new file mode 100644
index 00000000..78f7424e
--- /dev/null
+++ b/tests/xfs/1402.out
@@ -0,0 +1,5 @@
+QA output created by 1402
+Format and populate
+Find bmbt block
+Fuzz bmbt
+Done fuzzing bmbt
diff --git a/tests/xfs/1403 b/tests/xfs/1403
new file mode 100755
index 00000000..f504cc35
--- /dev/null
+++ b/tests/xfs/1403
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1403
+#
+# Populate a XFS filesystem and fuzz every symlink remote block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find symlink remote block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFLNK.FMT_EXTENTS)
+_scratch_unmount
+
+echo "Fuzz symlink remote block"
+_scratch_xfs_fuzz_metadata '' 'none' "inode ${inum}" 'dblock 0' >> $seqres.full
+echo "Done fuzzing symlink remote block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1403.out b/tests/xfs/1403.out
new file mode 100644
index 00000000..3ff10063
--- /dev/null
+++ b/tests/xfs/1403.out
@@ -0,0 +1,5 @@
+QA output created by 1403
+Format and populate
+Find symlink remote block
+Fuzz symlink remote block
+Done fuzzing symlink remote block
diff --git a/tests/xfs/1404 b/tests/xfs/1404
new file mode 100755
index 00000000..e3b1978b
--- /dev/null
+++ b/tests/xfs/1404
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1404
+#
+# Populate a XFS filesystem and fuzz every inline directory inode field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find inline-format dir inode"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFDIR.FMT_INLINE)
+_scratch_unmount
+
+echo "Fuzz inline-format dir inode"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" >> $seqres.full
+echo "Done fuzzing inline-format dir inode"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1404.out b/tests/xfs/1404.out
new file mode 100644
index 00000000..106ff63e
--- /dev/null
+++ b/tests/xfs/1404.out
@@ -0,0 +1,5 @@
+QA output created by 1404
+Format and populate
+Find inline-format dir inode
+Fuzz inline-format dir inode
+Done fuzzing inline-format dir inode
diff --git a/tests/xfs/1405 b/tests/xfs/1405
new file mode 100755
index 00000000..7d6dbbdb
--- /dev/null
+++ b/tests/xfs/1405
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1405
+#
+# Populate a XFS filesystem and fuzz every block-format dir block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find data-format dir block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFDIR.FMT_BLOCK)
+_scratch_unmount
+
+echo "Fuzz data-format dir block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" 'dblock 0' >> $seqres.full
+echo "Done fuzzing data-format dir block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1405.out b/tests/xfs/1405.out
new file mode 100644
index 00000000..3f194d24
--- /dev/null
+++ b/tests/xfs/1405.out
@@ -0,0 +1,5 @@
+QA output created by 1405
+Format and populate
+Find data-format dir block
+Fuzz data-format dir block
+Done fuzzing data-format dir block
diff --git a/tests/xfs/1406 b/tests/xfs/1406
new file mode 100755
index 00000000..f5df8f65
--- /dev/null
+++ b/tests/xfs/1406
@@ -0,0 +1,51 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1406
+#
+# Populate a XFS filesystem and fuzz every data-format dir block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find data-format dir block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFDIR.FMT_LEAF)
+blk_sz=$(_get_block_size $SCRATCH_MNT)
+_scratch_unmount
+
+echo "Fuzz data-format dir block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" "dblock 0" >> $seqres.full
+echo "Done fuzzing data-format dir block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1406.out b/tests/xfs/1406.out
new file mode 100644
index 00000000..32e8749f
--- /dev/null
+++ b/tests/xfs/1406.out
@@ -0,0 +1,5 @@
+QA output created by 1406
+Format and populate
+Find data-format dir block
+Fuzz data-format dir block
+Done fuzzing data-format dir block
diff --git a/tests/xfs/1407 b/tests/xfs/1407
new file mode 100755
index 00000000..d9ba2bef
--- /dev/null
+++ b/tests/xfs/1407
@@ -0,0 +1,52 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1407
+#
+# Populate a XFS filesystem and fuzz every leaf1-format dir block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find leaf1-format dir block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFDIR.FMT_LEAF)
+blk_sz=$(_get_block_size $SCRATCH_MNT)
+_scratch_unmount
+
+leaf_offset=$(( (2 ** 35) / blk_sz))
+echo "Fuzz leaf1-format dir block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" "dblock ${leaf_offset}" >> $seqres.full
+echo "Done fuzzing leaf1-format dir block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1407.out b/tests/xfs/1407.out
new file mode 100644
index 00000000..f9b8c3e1
--- /dev/null
+++ b/tests/xfs/1407.out
@@ -0,0 +1,5 @@
+QA output created by 1407
+Format and populate
+Find leaf1-format dir block
+Fuzz leaf1-format dir block
+Done fuzzing leaf1-format dir block
diff --git a/tests/xfs/1408 b/tests/xfs/1408
new file mode 100755
index 00000000..609080ce
--- /dev/null
+++ b/tests/xfs/1408
@@ -0,0 +1,52 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1408
+#
+# Populate a XFS filesystem and fuzz every leafn-format dir block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find leafn-format dir block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFDIR.FMT_NODE)
+blk_sz=$(_get_block_size $SCRATCH_MNT)
+_scratch_unmount
+
+leaf_offset=$(( ( (2 ** 35) / blk_sz) + 1))
+echo "Fuzz leafn-format dir block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" "dblock ${leaf_offset}" >> $seqres.full
+echo "Done fuzzing leafn-format dir block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1408.out b/tests/xfs/1408.out
new file mode 100644
index 00000000..b404dd87
--- /dev/null
+++ b/tests/xfs/1408.out
@@ -0,0 +1,5 @@
+QA output created by 1408
+Format and populate
+Find leafn-format dir block
+Fuzz leafn-format dir block
+Done fuzzing leafn-format dir block
diff --git a/tests/xfs/1409 b/tests/xfs/1409
new file mode 100755
index 00000000..5af0f572
--- /dev/null
+++ b/tests/xfs/1409
@@ -0,0 +1,52 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1409
+#
+# Populate a XFS filesystem and fuzz every node-format dir block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find node-format dir block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFDIR.FMT_NODE)
+blk_sz=$(_get_block_size $SCRATCH_MNT)
+_scratch_unmount
+
+leaf_offset=$(( (2 ** 35) / blk_sz ))
+echo "Fuzz node-format dir block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" "dblock ${leaf_offset}" >> $seqres.full
+echo "Done fuzzing node-format dir block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1409.out b/tests/xfs/1409.out
new file mode 100644
index 00000000..e0b5ae0b
--- /dev/null
+++ b/tests/xfs/1409.out
@@ -0,0 +1,5 @@
+QA output created by 1409
+Format and populate
+Find node-format dir block
+Fuzz node-format dir block
+Done fuzzing node-format dir block
diff --git a/tests/xfs/1410 b/tests/xfs/1410
new file mode 100755
index 00000000..b98ca791
--- /dev/null
+++ b/tests/xfs/1410
@@ -0,0 +1,52 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1410
+#
+# Populate a XFS filesystem and fuzz every freeindex-format dir block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find freeindex-format dir block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFDIR.FMT_NODE)
+blk_sz=$(_get_block_size $SCRATCH_MNT)
+_scratch_unmount
+
+leaf_offset=$(( (2 ** 36) / blk_sz ))
+echo "Fuzz freeindex-format dir block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" "dblock ${leaf_offset}" >> $seqres.full
+echo "Done fuzzing freeindex-format dir block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1410.out b/tests/xfs/1410.out
new file mode 100644
index 00000000..0e60d89d
--- /dev/null
+++ b/tests/xfs/1410.out
@@ -0,0 +1,5 @@
+QA output created by 1410
+Format and populate
+Find freeindex-format dir block
+Fuzz freeindex-format dir block
+Done fuzzing freeindex-format dir block
diff --git a/tests/xfs/1411 b/tests/xfs/1411
new file mode 100755
index 00000000..8f6de99a
--- /dev/null
+++ b/tests/xfs/1411
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1411
+#
+# Populate a XFS filesystem and fuzz every inline attr inode field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find inline-format attr inode"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/ATTR.FMT_LOCAL)
+_scratch_unmount
+
+echo "Fuzz inline-format attr inode"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" >> $seqres.full
+echo "Done fuzzing inline-format attr inode"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1411.out b/tests/xfs/1411.out
new file mode 100644
index 00000000..16cfbfa6
--- /dev/null
+++ b/tests/xfs/1411.out
@@ -0,0 +1,5 @@
+QA output created by 1411
+Format and populate
+Find inline-format attr inode
+Fuzz inline-format attr inode
+Done fuzzing inline-format attr inode
diff --git a/tests/xfs/1412 b/tests/xfs/1412
new file mode 100755
index 00000000..f63e59ec
--- /dev/null
+++ b/tests/xfs/1412
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1412
+#
+# Populate a XFS filesystem and fuzz every leaf-format attr block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find leaf-format attr block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/ATTR.FMT_LEAF)
+_scratch_unmount
+
+echo "Fuzz leaf-format attr block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" 'ablock 0' >> $seqres.full
+echo "Done fuzzing leaf-format attr block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1412.out b/tests/xfs/1412.out
new file mode 100644
index 00000000..41614772
--- /dev/null
+++ b/tests/xfs/1412.out
@@ -0,0 +1,5 @@
+QA output created by 1412
+Format and populate
+Find leaf-format attr block
+Fuzz leaf-format attr block
+Done fuzzing leaf-format attr block
diff --git a/tests/xfs/1413 b/tests/xfs/1413
new file mode 100755
index 00000000..22cae22e
--- /dev/null
+++ b/tests/xfs/1413
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1413
+#
+# Populate a XFS filesystem and fuzz every node-format attr block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find node-format attr block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/ATTR.FMT_NODE)
+_scratch_unmount
+
+echo "Fuzz node-format attr block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" "ablock 0" >> $seqres.full
+echo "Done fuzzing node-format attr block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1413.out b/tests/xfs/1413.out
new file mode 100644
index 00000000..7c295771
--- /dev/null
+++ b/tests/xfs/1413.out
@@ -0,0 +1,5 @@
+QA output created by 1413
+Format and populate
+Find node-format attr block
+Fuzz node-format attr block
+Done fuzzing node-format attr block
diff --git a/tests/xfs/1414 b/tests/xfs/1414
new file mode 100755
index 00000000..a6c96d8e
--- /dev/null
+++ b/tests/xfs/1414
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1414
+#
+# Populate a XFS filesystem and fuzz every external attr block field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find external attr block"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/ATTR.FMT_EXTENTS_REMOTE3K)
+_scratch_unmount
+
+echo "Fuzz external attr block"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" "ablock 1" >> $seqres.full
+echo "Done fuzzing external attr block"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1414.out b/tests/xfs/1414.out
new file mode 100644
index 00000000..ede45f43
--- /dev/null
+++ b/tests/xfs/1414.out
@@ -0,0 +1,5 @@
+QA output created by 1414
+Format and populate
+Find external attr block
+Fuzz external attr block
+Done fuzzing external attr block
diff --git a/tests/xfs/1415 b/tests/xfs/1415
new file mode 100755
index 00000000..711b9ec0
--- /dev/null
+++ b/tests/xfs/1415
@@ -0,0 +1,49 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1415
+#
+# Populate a XFS filesystem and fuzz every rtrmapbt record field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_realtime
+_require_xfs_scratch_rmapbt
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+inode_ver=$(_scratch_xfs_get_metadata_field "core.version" 'sb 0' 'addr rrmapino')
+
+echo "Fuzz rtrmapbt recs"
+_scratch_xfs_fuzz_metadata '' 'none' 'sb 0' 'addr rrmapino' "addr u${inode_ver}.rtrmapbt.ptrs[1]" >> $seqres.full
+echo "Done fuzzing rtrmapbt recs"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1415.out b/tests/xfs/1415.out
new file mode 100644
index 00000000..d23b46bf
--- /dev/null
+++ b/tests/xfs/1415.out
@@ -0,0 +1,4 @@
+QA output created by 1415
+Format and populate
+Fuzz rtrmapbt recs
+Done fuzzing rtrmapbt recs
diff --git a/tests/xfs/1416 b/tests/xfs/1416
new file mode 100755
index 00000000..addc9342
--- /dev/null
+++ b/tests/xfs/1416
@@ -0,0 +1,47 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1416
+#
+# Populate a XFS filesystem and fuzz every rtrmapbt keyptr field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_realtime
+_require_xfs_scratch_rmapbt
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz rtrmapbt keyptrs"
+_scratch_xfs_fuzz_metadata '(rtrmapbt)' 'offline' 'sb 0' 'addr rrmapino' >> $seqres.full
+echo "Done fuzzing rtrmapbt keyptrs"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1416.out b/tests/xfs/1416.out
new file mode 100644
index 00000000..e368a20e
--- /dev/null
+++ b/tests/xfs/1416.out
@@ -0,0 +1,4 @@
+QA output created by 1416
+Format and populate
+Fuzz rtrmapbt keyptrs
+Done fuzzing rtrmapbt keyptrs
diff --git a/tests/xfs/1417 b/tests/xfs/1417
new file mode 100755
index 00000000..c7a990a2
--- /dev/null
+++ b/tests/xfs/1417
@@ -0,0 +1,47 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1417
+#
+# Populate a XFS filesystem and fuzz every refcountbt field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+. ./common/reflink
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_reflink
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Fuzz refcountbt"
+_scratch_xfs_fuzz_metadata '' 'none'  'agf 0' 'addr refcntroot' 'addr ptrs[1]' >> $seqres.full
+echo "Done fuzzing refcountbt"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1417.out b/tests/xfs/1417.out
new file mode 100644
index 00000000..4a505f1c
--- /dev/null
+++ b/tests/xfs/1417.out
@@ -0,0 +1,4 @@
+QA output created by 1417
+Format and populate
+Fuzz refcountbt
+Done fuzzing refcountbt
diff --git a/tests/xfs/1418 b/tests/xfs/1418
new file mode 100755
index 00000000..d722d233
--- /dev/null
+++ b/tests/xfs/1418
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1418
+#
+# Populate a XFS filesystem and fuzz every btree-format attr inode field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find btree-format attr inode"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/ATTR.FMT_BTREE)
+_scratch_unmount
+
+echo "Fuzz inode"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" >> $seqres.full
+echo "Done fuzzing inode"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1418.out b/tests/xfs/1418.out
new file mode 100644
index 00000000..d5864640
--- /dev/null
+++ b/tests/xfs/1418.out
@@ -0,0 +1,5 @@
+QA output created by 1418
+Format and populate
+Find btree-format attr inode
+Fuzz inode
+Done fuzzing inode
diff --git a/tests/xfs/1419 b/tests/xfs/1419
new file mode 100755
index 00000000..79467be8
--- /dev/null
+++ b/tests/xfs/1419
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1419
+#
+# Populate a XFS filesystem and fuzz every blockdev inode field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find blockdev inode"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFBLK)
+_scratch_unmount
+
+echo "Fuzz inode"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" >> $seqres.full
+echo "Done fuzzing inode"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1419.out b/tests/xfs/1419.out
new file mode 100644
index 00000000..10af3bb3
--- /dev/null
+++ b/tests/xfs/1419.out
@@ -0,0 +1,5 @@
+QA output created by 1419
+Format and populate
+Find blockdev inode
+Fuzz inode
+Done fuzzing inode
diff --git a/tests/xfs/1420 b/tests/xfs/1420
new file mode 100755
index 00000000..b07205bd
--- /dev/null
+++ b/tests/xfs/1420
@@ -0,0 +1,50 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1420
+#
+# Populate a XFS filesystem and fuzz every local-format symlink inode field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+
+echo "Find local-format symlink inode"
+_scratch_mount
+inum=$(stat -c '%i' $SCRATCH_MNT/S_IFLNK.FMT_LOCAL)
+_scratch_unmount
+
+echo "Fuzz inode"
+_scratch_xfs_fuzz_metadata '' 'none'  "inode ${inum}" >> $seqres.full
+echo "Done fuzzing inode"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1420.out b/tests/xfs/1420.out
new file mode 100644
index 00000000..c82242ce
--- /dev/null
+++ b/tests/xfs/1420.out
@@ -0,0 +1,5 @@
+QA output created by 1420
+Format and populate
+Find local-format symlink inode
+Fuzz inode
+Done fuzzing inode
diff --git a/tests/xfs/1421 b/tests/xfs/1421
new file mode 100755
index 00000000..81f83e11
--- /dev/null
+++ b/tests/xfs/1421
@@ -0,0 +1,48 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1421
+#
+# Populate a XFS filesystem and fuzz every user dquot field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+. ./common/quota
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+_require_quota
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+echo "${MOUNT_OPTIONS}" | grep -q 'usrquota' || _notrun "user quota disabled"
+
+echo "Fuzz user 0 dquot"
+_scratch_xfs_fuzz_metadata '' 'none'  "dquot -u 0" >> $seqres.full
+echo "Done fuzzing dquot"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1421.out b/tests/xfs/1421.out
new file mode 100644
index 00000000..8a50226a
--- /dev/null
+++ b/tests/xfs/1421.out
@@ -0,0 +1,4 @@
+QA output created by 1421
+Format and populate
+Fuzz user 0 dquot
+Done fuzzing dquot
diff --git a/tests/xfs/1422 b/tests/xfs/1422
new file mode 100755
index 00000000..8a74edad
--- /dev/null
+++ b/tests/xfs/1422
@@ -0,0 +1,48 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1422
+#
+# Populate a XFS filesystem and fuzz every group dquot field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+. ./common/quota
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+_require_quota
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+echo "${MOUNT_OPTIONS}" | grep -q 'grpquota' || _notrun "group quota disabled"
+
+echo "Fuzz group 0 dquot"
+_scratch_xfs_fuzz_metadata '' 'none'  "dquot -g 0" >> $seqres.full
+echo "Done fuzzing dquot"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1422.out b/tests/xfs/1422.out
new file mode 100644
index 00000000..728e73f7
--- /dev/null
+++ b/tests/xfs/1422.out
@@ -0,0 +1,4 @@
+QA output created by 1422
+Format and populate
+Fuzz group 0 dquot
+Done fuzzing dquot
diff --git a/tests/xfs/1423 b/tests/xfs/1423
new file mode 100755
index 00000000..f49fbfde
--- /dev/null
+++ b/tests/xfs/1423
@@ -0,0 +1,48 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 1423
+#
+# Populate a XFS filesystem and fuzz every project dquot field.
+# Do not fix the filesystem, to test metadata verifiers.
+
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 7 15
+
+_cleanup()
+{
+	cd /
+	rm -rf $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+. ./common/populate
+. ./common/fuzzy
+. ./common/quota
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_scratch_xfs_fuzz_fields
+_require_quota
+
+echo "Format and populate"
+_scratch_populate_cached nofill > $seqres.full 2>&1
+echo "${MOUNT_OPTIONS}" | grep -q 'prjquota' || _notrun "project quota disabled"
+
+echo "Fuzz project 0 dquot"
+_scratch_xfs_fuzz_metadata '' 'none'  "dquot -p 0" >> $seqres.full
+echo "Done fuzzing dquot"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/1423.out b/tests/xfs/1423.out
new file mode 100644
index 00000000..8a679f76
--- /dev/null
+++ b/tests/xfs/1423.out
@@ -0,0 +1,4 @@
+QA output created by 1423
+Format and populate
+Fuzz project 0 dquot
+Done fuzzing dquot
diff --git a/tests/xfs/group b/tests/xfs/group
index 2f1c8467..b70b4134 100644
--- a/tests/xfs/group
+++ b/tests/xfs/group
@@ -448,3 +448,40 @@
 448 auto quick fuzzers
 449 auto quick
 712 auto quick rmap
+1387 dangerous_fuzzers dangerous_norepair
+1388 dangerous_fuzzers dangerous_norepair
+1389 dangerous_fuzzers dangerous_norepair
+1390 dangerous_fuzzers dangerous_norepair
+1391 dangerous_fuzzers dangerous_norepair
+1392 dangerous_fuzzers dangerous_norepair
+1393 dangerous_fuzzers dangerous_norepair
+1394 dangerous_fuzzers dangerous_norepair
+1395 dangerous_fuzzers dangerous_norepair
+1396 dangerous_fuzzers dangerous_norepair
+1397 dangerous_fuzzers dangerous_norepair
+1398 dangerous_fuzzers dangerous_norepair
+1399 dangerous_fuzzers dangerous_norepair
+1400 dangerous_fuzzers dangerous_norepair
+1401 dangerous_fuzzers dangerous_norepair
+1402 dangerous_fuzzers dangerous_norepair
+1403 dangerous_fuzzers dangerous_norepair
+1404 dangerous_fuzzers dangerous_norepair
+1405 dangerous_fuzzers dangerous_norepair
+1406 dangerous_fuzzers dangerous_norepair
+1407 dangerous_fuzzers dangerous_norepair
+1408 dangerous_fuzzers dangerous_norepair
+1409 dangerous_fuzzers dangerous_norepair
+1410 dangerous_fuzzers dangerous_norepair
+1411 dangerous_fuzzers dangerous_norepair
+1412 dangerous_fuzzers dangerous_norepair
+1413 dangerous_fuzzers dangerous_norepair
+1414 dangerous_fuzzers dangerous_norepair
+1415 dangerous_fuzzers dangerous_norepair
+1416 dangerous_fuzzers dangerous_norepair
+1417 dangerous_fuzzers dangerous_norepair
+1418 dangerous_fuzzers dangerous_norepair
+1419 dangerous_fuzzers dangerous_norepair
+1420 dangerous_fuzzers dangerous_norepair
+1421 dangerous_fuzzers dangerous_norepair
+1422 dangerous_fuzzers dangerous_norepair
+1423 dangerous_fuzzers dangerous_norepair

Re: [PATCH 5/8] xfs: recheck reflink state after grabbing ILOCK_SHARED for a write

[Allison Henderson]

On 06/21/2018 11:31 AM, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> In "xfs: fix fdblocks accounting w/ RMAPBT per-AG reservation", we fixed
> the per-ag reservation code so that we always decrease fdblocks by the
> reserved size because rmapbt blocks are counted as free space.
> 
> The primary symptom of this bug is that if the rmapbt has expanded since
> mount time, the disk block counters reported via statfs will change
> across a remount.  Therefore, we exercise this as a regression test.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
>   tests/xfs/712     |   62 +++++++++++++++++++++++++++++++++++++++++++++++++++++
>   tests/xfs/712.out |    1 +
>   tests/xfs/group   |    1 +
>   3 files changed, 64 insertions(+)
>   create mode 100755 tests/xfs/712
>   create mode 100644 tests/xfs/712.out

Humm, was there supposed to be more to this maybe?  Shouldn't we see a 
712.out somewhere?
> 
> 
> diff --git a/tests/xfs/712 b/tests/xfs/712
> new file mode 100755
> index 00000000..f90c7ec9
> --- /dev/null
> +++ b/tests/xfs/712
> @@ -0,0 +1,62 @@
> +#! /bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
> +#
> +# FS QA Test No. 712
> +#
> +# Make sure that the statfs b_avail counter doesn't change across remount
> +# after the rmapbt has grown in size.
> +#
> +seq=`basename $0`
> +seqres=$RESULT_DIR/$seq
> +echo "QA output created by $seq"
> +
> +here=`pwd`
> +tmp=/tmp/$$
> +status=1	# failure is the default!
> +trap "_cleanup; exit \$status" 0 1 2 3 15
> +
> +_cleanup()
> +{
> +	cd /
> +	rm -f $tmp.*
> +}
> +
> +# get standard environment, filters and checks
> +. ./common/rc
> +. ./common/filter
> +
> +# remo
> 

Re: [PATCH 5/8] xfs: recheck reflink state after grabbing ILOCK_SHARED for a write

[Darrick J. Wong]

On Thu, Jun 21, 2018 at 11:35:38PM -0700, Allison Henderson wrote:
> On 06/21/2018 11:31 AM, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > In "xfs: fix fdblocks accounting w/ RMAPBT per-AG reservation", we fixed
> > the per-ag reservation code so that we always decrease fdblocks by the
> > reserved size because rmapbt blocks are counted as free space.
> > 
> > The primary symptom of this bug is that if the rmapbt has expanded since
> > mount time, the disk block counters reported via statfs will change
> > across a remount.  Therefore, we exercise this as a regression test.
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > ---
> >   tests/xfs/712     |   62 +++++++++++++++++++++++++++++++++++++++++++++++++++++
> >   tests/xfs/712.out |    1 +
> >   tests/xfs/group   |    1 +
> >   3 files changed, 64 insertions(+)
> >   create mode 100755 tests/xfs/712
> >   create mode 100644 tests/xfs/712.out
> 
> Humm, was there supposed to be more to this maybe?  Shouldn't we see a
> 712.out somewhere?
> > 
> > 
> > diff --git a/tests/xfs/712 b/tests/xfs/712
> > new file mode 100755
> > index 00000000..f90c7ec9
> > --- /dev/null
> > +++ b/tests/xfs/712
> > @@ -0,0 +1,62 @@
> > +#! /bin/bash
> > +# SPDX-License-Identifier: GPL-2.0
> > +# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
> > +#
> > +# FS QA Test No. 712
> > +#
> > +# Make sure that the statfs b_avail counter doesn't change across remount
> > +# after the rmapbt has grown in size.
> > +#
> > +seq=`basename $0`
> > +seqres=$RESULT_DIR/$seq
> > +echo "QA output created by $seq"
> > +
> > +here=`pwd`
> > +tmp=/tmp/$$
> > +status=1	# failure is the default!
> > +trap "_cleanup; exit \$status" 0 1 2 3 15
> > +
> > +_cleanup()
> > +{
> > +	cd /
> > +	rm -f $tmp.*
> > +}
> > +
> > +# get standard environment, filters and checks
> > +. ./common/rc
> > +. ./common/filter
> > +
> > +# remo
> > 

Hmm, well, you did actually catch that I omitted the usual "Silence is
golden" but I do wonder about this cutting off right there....

Will send v2.

--D

> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH v2 2/4] xfs: regression test for rmapbt fdblocks accounting problems

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

In "xfs: fix fdblocks accounting w/ RMAPBT per-AG reservation", we fixed
the per-ag reservation code so that we always decrease fdblocks by the
reserved size because rmapbt blocks are counted as free space.

The primary symptom of this bug is that if the rmapbt has expanded since
mount time, the disk block counters reported via statfs will change
across a remount.  Therefore, we exercise this as a regression test.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
v2: add silence is golden message
---
 tests/xfs/712     |   64 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/712.out |    2 ++
 tests/xfs/group   |    1 +
 3 files changed, 67 insertions(+)
 create mode 100755 tests/xfs/712
 create mode 100644 tests/xfs/712.out

diff --git a/tests/xfs/712 b/tests/xfs/712
new file mode 100755
index 00000000..ab2342ef
--- /dev/null
+++ b/tests/xfs/712
@@ -0,0 +1,64 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2018 Oracle, Inc.  All rights reserved.
+#
+# FS QA Test No. 712
+#
+# Make sure that the statfs b_avail counter doesn't change across remount
+# after the rmapbt has grown in size.
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+
+# remove previous \$seqres.full before test
+rm -f $seqres.full
+
+# real QA test starts here
+_supported_os Linux
+_supported_fs xfs
+_require_test_program "punch-alternating"
+_require_xfs_scratch_rmapbt
+
+_scratch_mkfs >> $seqres.full
+_scratch_mount
+
+# Make sure we allocate a big enough file such that punching out every other
+# block will cause the rmapbt to expand by at least one block.
+blksz=$(_get_file_block_size $SCRATCH_MNT)
+nr_rmap_per_rmapbt=$(( (blksz - 56) / 24))
+blks=$(( (nr_rmap_per_rmapbt + 2) * 2))
+$XFS_IO_PROG -f -c "falloc 0 $((blks * blksz))" $SCRATCH_MNT/a >> $seqres.full
+./src/punch-alternating $SCRATCH_MNT/a
+
+# Do the stat counters change across the remount?
+before=$(stat -f -c '%b %f' $SCRATCH_MNT)
+_scratch_cycle_mount
+after=$(stat -f -c '%b %f' $SCRATCH_MNT)
+
+if [ "${before}" != "${after}" ]; then
+	echo "counters changed: ${before} ${after}"
+	echo "before: ${before}" >> $seqres.full
+	echo "after: ${after}" >> $seqres.full
+fi
+
+echo "Silence is golden."
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/712.out b/tests/xfs/712.out
new file mode 100644
index 00000000..33a76b21
--- /dev/null
+++ b/tests/xfs/712.out
@@ -0,0 +1,2 @@
+QA output created by 712
+Silence is golden.
diff --git a/tests/xfs/group b/tests/xfs/group
index 932ab909..2f1c8467 100644
--- a/tests/xfs/group
+++ b/tests/xfs/group
@@ -447,3 +447,4 @@
 447 auto mount
 448 auto quick fuzzers
 449 auto quick
+712 auto quick rmap

Re: [PATCH 3/4] generic: mread past eof shows nonzero contents

[Eryu Guan]

On Thu, Jun 21, 2018 at 11:32:49AM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Certain sequences of generic/127 invocations complain about being able
> to mread nonzero contents past eof.  Replicate that here as a regression
> test.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> ---
>  tests/generic/708     |   54 +++++++++++++++++++++++++++++++++++++++++++++++++
>  tests/generic/708.out |    2 ++
>  tests/generic/group   |    1 +
>  3 files changed, 57 insertions(+)
>  create mode 100755 tests/generic/708
>  create mode 100644 tests/generic/708.out
> 
> 
> diff --git a/tests/generic/708 b/tests/generic/708
> new file mode 100755
> index 00000000..d380053f
> --- /dev/null
> +++ b/tests/generic/708
> @@ -0,0 +1,54 @@
> +#! /bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +# Copyright (c) 2018 Oracle, Inc.  All Rights Reserved.
> +#
> +# FS QA Test No. 708
> +#
> +# Test a specific sequence of fsx operations that causes an mmap read past
> +# eof to return nonzero contents.
> +#
> +seq=`basename $0`
> +seqres=$RESULT_DIR/$seq
> +echo "QA output created by $seq"
> +tmp=/tmp/$$
> +status=1	# failure is the default!
> +trap "_cleanup; exit \$status" 0 1 2 3 15
> +
> +_cleanup()
> +{
> +	cd /
> +	rm -f $tmp.*
> +}
> +
> +# get standard environment, filters and checks
> +. ./common/rc
> +
> +# real QA test starts here
> +_supported_fs generic
> +_supported_os Linux
> +_require_scratch
> +
> +rm -f $seqres.full
> +
> +_scratch_mkfs >>$seqres.full 2>&1
> +_scratch_mount
> +
> +cat >> $tmp.fsxops << ENDL
> +fallocate 0x77e2 0x5f06 0x269a2 keep_size
> +mapwrite 0x2e7fc 0x42ba 0x3f989
> +write 0x67a9 0x714e 0x3f989
> +write 0x39f96 0x185a 0x3f989
> +collapse_range 0x36000 0x8000 0x3f989
> +mapread 0x74c0 0x1bb3 0x3e2d0
> +truncate 0x0 0x8aa2 0x3e2d0
> +zero_range 0x1265 0x783d 0x8aa2
> +mapread 0x7bd8 0xeca 0x8aa2
> +ENDL
> +
> +victim=$SCRATCH_MNT/a
> +touch $victim
> +$here/ltp/fsx --replay-ops $tmp.fsxops $victim > $tmp.output || cat $tmp.output

This fails when $FSTYP doesn't support fallocate and the related flags,
e.g. ext2 fails as

 QA output created by 708
 +main: filesystem does not support fallocate mode 0, disabling!
 +main: filesystem does not support fallocate mode FALLOC_FL_KEEP_SIZE, disabling!
 +main: filesystem does not support fallocate mode FALLOC_FL_ZERO_RANGE, disabling!
 +main: filesystem does not support fallocate mode FALLOC_FL_COLLAPSE_RANGE, disabling!
 +main: filesystem does not support fallocate mode FALLOC_FL_INSERT_RANGE, disabling!
  Silence is golden

The messages are just informative, I throw stderr to $tmp.output too on
commit.

Thanks,
Eryu

> +
> +echo "Silence is golden"
> +status=0
> +exit
> diff --git a/tests/generic/708.out b/tests/generic/708.out
> new file mode 100644
> index 00000000..33c478ad
> --- /dev/null
> +++ b/tests/generic/708.out
> @@ -0,0 +1,2 @@
> +QA output created by 708
> +Silence is golden
> diff --git a/tests/generic/group b/tests/generic/group
> index 83a6fdab..1a1a0a6e 100644
> --- a/tests/generic/group
> +++ b/tests/generic/group
> @@ -501,3 +501,4 @@
>  496 auto quick swap
>  497 auto quick swap collapse
>  498 auto quick log
> +708 auto quick rw collapse
> 

Re: [PATCH 3/4] generic: mread past eof shows nonzero contents

[Darrick J. Wong]

On Mon, Jun 25, 2018 at 12:00:54PM +0800, Eryu Guan wrote:
> On Thu, Jun 21, 2018 at 11:32:49AM -0700, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > Certain sequences of generic/127 invocations complain about being able
> > to mread nonzero contents past eof.  Replicate that here as a regression
> > test.
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > ---
> >  tests/generic/708     |   54 +++++++++++++++++++++++++++++++++++++++++++++++++
> >  tests/generic/708.out |    2 ++
> >  tests/generic/group   |    1 +
> >  3 files changed, 57 insertions(+)
> >  create mode 100755 tests/generic/708
> >  create mode 100644 tests/generic/708.out
> > 
> > 
> > diff --git a/tests/generic/708 b/tests/generic/708
> > new file mode 100755
> > index 00000000..d380053f
> > --- /dev/null
> > +++ b/tests/generic/708
> > @@ -0,0 +1,54 @@
> > +#! /bin/bash
> > +# SPDX-License-Identifier: GPL-2.0
> > +# Copyright (c) 2018 Oracle, Inc.  All Rights Reserved.
> > +#
> > +# FS QA Test No. 708
> > +#
> > +# Test a specific sequence of fsx operations that causes an mmap read past
> > +# eof to return nonzero contents.
> > +#
> > +seq=`basename $0`
> > +seqres=$RESULT_DIR/$seq
> > +echo "QA output created by $seq"
> > +tmp=/tmp/$$
> > +status=1	# failure is the default!
> > +trap "_cleanup; exit \$status" 0 1 2 3 15
> > +
> > +_cleanup()
> > +{
> > +	cd /
> > +	rm -f $tmp.*
> > +}
> > +
> > +# get standard environment, filters and checks
> > +. ./common/rc
> > +
> > +# real QA test starts here
> > +_supported_fs generic
> > +_supported_os Linux
> > +_require_scratch
> > +
> > +rm -f $seqres.full
> > +
> > +_scratch_mkfs >>$seqres.full 2>&1
> > +_scratch_mount
> > +
> > +cat >> $tmp.fsxops << ENDL
> > +fallocate 0x77e2 0x5f06 0x269a2 keep_size
> > +mapwrite 0x2e7fc 0x42ba 0x3f989
> > +write 0x67a9 0x714e 0x3f989
> > +write 0x39f96 0x185a 0x3f989
> > +collapse_range 0x36000 0x8000 0x3f989
> > +mapread 0x74c0 0x1bb3 0x3e2d0
> > +truncate 0x0 0x8aa2 0x3e2d0
> > +zero_range 0x1265 0x783d 0x8aa2
> > +mapread 0x7bd8 0xeca 0x8aa2
> > +ENDL
> > +
> > +victim=$SCRATCH_MNT/a
> > +touch $victim
> > +$here/ltp/fsx --replay-ops $tmp.fsxops $victim > $tmp.output || cat $tmp.output
> 
> This fails when $FSTYP doesn't support fallocate and the related flags,
> e.g. ext2 fails as
> 
>  QA output created by 708
>  +main: filesystem does not support fallocate mode 0, disabling!
>  +main: filesystem does not support fallocate mode FALLOC_FL_KEEP_SIZE, disabling!
>  +main: filesystem does not support fallocate mode FALLOC_FL_ZERO_RANGE, disabling!
>  +main: filesystem does not support fallocate mode FALLOC_FL_COLLAPSE_RANGE, disabling!
>  +main: filesystem does not support fallocate mode FALLOC_FL_INSERT_RANGE, disabling!

Uhoh, the collapse/zero/insert checks got committed to the wrong patch.
:(

Will clean this up and resubmit.

--D

>   Silence is golden
> 
> The messages are just informative, I throw stderr to $tmp.output too on
> commit.
> 
> Thanks,
> Eryu
> 
> > +
> > +echo "Silence is golden"
> > +status=0
> > +exit
> > diff --git a/tests/generic/708.out b/tests/generic/708.out
> > new file mode 100644
> > index 00000000..33c478ad
> > --- /dev/null
> > +++ b/tests/generic/708.out
> > @@ -0,0 +1,2 @@
> > +QA output created by 708
> > +Silence is golden
> > diff --git a/tests/generic/group b/tests/generic/group
> > index 83a6fdab..1a1a0a6e 100644
> > --- a/tests/generic/group
> > +++ b/tests/generic/group
> > @@ -501,3 +501,4 @@
> >  496 auto quick swap
> >  497 auto quick swap collapse
> >  498 auto quick log
> > +708 auto quick rw collapse
> > 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 3/4] generic: mread past eof shows nonzero contents

[Eryu Guan]

On Mon, Jun 25, 2018 at 08:34:23AM -0700, Darrick J. Wong wrote:
> On Mon, Jun 25, 2018 at 12:00:54PM +0800, Eryu Guan wrote:
> > On Thu, Jun 21, 2018 at 11:32:49AM -0700, Darrick J. Wong wrote:
> > > From: Darrick J. Wong <darrick.wong@oracle.com>
> > > 
> > > Certain sequences of generic/127 invocations complain about being able
> > > to mread nonzero contents past eof.  Replicate that here as a regression
> > > test.
> > > 
> > > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> > > ---
> > >  tests/generic/708     |   54 +++++++++++++++++++++++++++++++++++++++++++++++++
> > >  tests/generic/708.out |    2 ++
> > >  tests/generic/group   |    1 +
> > >  3 files changed, 57 insertions(+)
> > >  create mode 100755 tests/generic/708
> > >  create mode 100644 tests/generic/708.out
> > > 
> > > 
> > > diff --git a/tests/generic/708 b/tests/generic/708
> > > new file mode 100755
> > > index 00000000..d380053f
> > > --- /dev/null
> > > +++ b/tests/generic/708
> > > @@ -0,0 +1,54 @@
> > > +#! /bin/bash
> > > +# SPDX-License-Identifier: GPL-2.0
> > > +# Copyright (c) 2018 Oracle, Inc.  All Rights Reserved.
> > > +#
> > > +# FS QA Test No. 708
> > > +#
> > > +# Test a specific sequence of fsx operations that causes an mmap read past
> > > +# eof to return nonzero contents.
> > > +#
> > > +seq=`basename $0`
> > > +seqres=$RESULT_DIR/$seq
> > > +echo "QA output created by $seq"
> > > +tmp=/tmp/$$
> > > +status=1	# failure is the default!
> > > +trap "_cleanup; exit \$status" 0 1 2 3 15
> > > +
> > > +_cleanup()
> > > +{
> > > +	cd /
> > > +	rm -f $tmp.*
> > > +}
> > > +
> > > +# get standard environment, filters and checks
> > > +. ./common/rc
> > > +
> > > +# real QA test starts here
> > > +_supported_fs generic
> > > +_supported_os Linux
> > > +_require_scratch
> > > +
> > > +rm -f $seqres.full
> > > +
> > > +_scratch_mkfs >>$seqres.full 2>&1
> > > +_scratch_mount
> > > +
> > > +cat >> $tmp.fsxops << ENDL
> > > +fallocate 0x77e2 0x5f06 0x269a2 keep_size
> > > +mapwrite 0x2e7fc 0x42ba 0x3f989
> > > +write 0x67a9 0x714e 0x3f989
> > > +write 0x39f96 0x185a 0x3f989
> > > +collapse_range 0x36000 0x8000 0x3f989
> > > +mapread 0x74c0 0x1bb3 0x3e2d0
> > > +truncate 0x0 0x8aa2 0x3e2d0
> > > +zero_range 0x1265 0x783d 0x8aa2
> > > +mapread 0x7bd8 0xeca 0x8aa2
> > > +ENDL
> > > +
> > > +victim=$SCRATCH_MNT/a
> > > +touch $victim
> > > +$here/ltp/fsx --replay-ops $tmp.fsxops $victim > $tmp.output || cat $tmp.output
> > 
> > This fails when $FSTYP doesn't support fallocate and the related flags,
> > e.g. ext2 fails as
> > 
> >  QA output created by 708
> >  +main: filesystem does not support fallocate mode 0, disabling!
> >  +main: filesystem does not support fallocate mode FALLOC_FL_KEEP_SIZE, disabling!
> >  +main: filesystem does not support fallocate mode FALLOC_FL_ZERO_RANGE, disabling!
> >  +main: filesystem does not support fallocate mode FALLOC_FL_COLLAPSE_RANGE, disabling!
> >  +main: filesystem does not support fallocate mode FALLOC_FL_INSERT_RANGE, disabling!
> 
> Uhoh, the collapse/zero/insert checks got committed to the wrong patch.
> :(
> 
> Will clean this up and resubmit.

Then I'll drop this patch for now, thanks!

Eryu

> 
> --D
> 
> >   Silence is golden
> > 
> > The messages are just informative, I throw stderr to $tmp.output too on
> > commit.
> > 
> > Thanks,
> > Eryu
> > 
> > > +
> > > +echo "Silence is golden"
> > > +status=0
> > > +exit
> > > diff --git a/tests/generic/708.out b/tests/generic/708.out
> > > new file mode 100644
> > > index 00000000..33c478ad
> > > --- /dev/null
> > > +++ b/tests/generic/708.out
> > > @@ -0,0 +1,2 @@
> > > +QA output created by 708
> > > +Silence is golden
> > > diff --git a/tests/generic/group b/tests/generic/group
> > > index 83a6fdab..1a1a0a6e 100644
> > > --- a/tests/generic/group
> > > +++ b/tests/generic/group
> > > @@ -501,3 +501,4 @@
> > >  496 auto quick swap
> > >  497 auto quick swap collapse
> > >  498 auto quick log
> > > +708 auto quick rw collapse
> > > 
> > --
> > To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 4/4] xfs: fuzz every field of every structure and test kernel crashes

[Eryu Guan]

On Thu, Jun 21, 2018 at 11:32:55AM -0700, Darrick J. Wong wrote:
> From: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Fuzz every field of every structure and then try to write the
> filesystem, to see how many of these writes can crash the kernel.
> 
> Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>

Almost all the tests here are failing in similar ways with v4.18-rc1
kernel and latest xfsprogs from for-next branch, e.g. xfs/1423 fails as

    +re-repair failed (1) with diskdq.magic = zeroes.
    +re-repair failed (1) with diskdq.magic = ones.
    +re-repair failed (1) with diskdq.magic = firstbit.
    +re-repair failed (1) with diskdq.magic = middlebit.

Seems like we should skip re-repair in the "none" repair mode too in
__scratch_xfs_fuzz_field_test?

Thanks,
Eryu

Re: [PATCH 4/4] xfs: fuzz every field of every structure and test kernel crashes

[Darrick J. Wong]

On Thu, Jun 28, 2018 at 11:10:27AM +0800, Eryu Guan wrote:
> On Thu, Jun 21, 2018 at 11:32:55AM -0700, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > Fuzz every field of every structure and then try to write the
> > filesystem, to see how many of these writes can crash the kernel.
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Almost all the tests here are failing in similar ways with v4.18-rc1
> kernel and latest xfsprogs from for-next branch, e.g. xfs/1423 fails as
> 
>     +re-repair failed (1) with diskdq.magic = zeroes.
>     +re-repair failed (1) with diskdq.magic = ones.
>     +re-repair failed (1) with diskdq.magic = firstbit.
>     +re-repair failed (1) with diskdq.magic = middlebit.
> 
> Seems like we should skip re-repair in the "none" repair mode too in
> __scratch_xfs_fuzz_field_test?

Err, yep.  I'll go fix that up too. :)

--D

> Thanks,
> Eryu
> --
> To unsubscribe from this list: send the line "unsubscribe linux-xfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH 4/4] xfs: fuzz every field of every structure and test kernel crashes

[Darrick J. Wong]

On Thu, Jun 28, 2018 at 11:10:27AM +0800, Eryu Guan wrote:
> On Thu, Jun 21, 2018 at 11:32:55AM -0700, Darrick J. Wong wrote:
> > From: Darrick J. Wong <darrick.wong@oracle.com>
> > 
> > Fuzz every field of every structure and then try to write the
> > filesystem, to see how many of these writes can crash the kernel.
> > 
> > Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
> 
> Almost all the tests here are failing in similar ways with v4.18-rc1
> kernel and latest xfsprogs from for-next branch, e.g. xfs/1423 fails as
> 
>     +re-repair failed (1) with diskdq.magic = zeroes.
>     +re-repair failed (1) with diskdq.magic = ones.
>     +re-repair failed (1) with diskdq.magic = firstbit.
>     +re-repair failed (1) with diskdq.magic = middlebit.
> 
> Seems like we should skip re-repair in the "none" repair mode too in
> __scratch_xfs_fuzz_field_test?

Makes sense, will fix & resubmit.

--D

> 
> Thanks,
> Eryu

Re: [PATCH 5/8] xfs: recheck reflink state after grabbing ILOCK_SHARED for a write

[Christoph Hellwig]

Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>

[PATCH 5/8] xfs: recheck reflink state after grabbing ILOCK_SHARED for a write

[Darrick J. Wong]

From: Darrick J. Wong <darrick.wong@oracle.com>

The reflink iflag could have changed since the earlier unlocked check,
so if we got ILOCK_SHARED for a write and but we're now a reflink inode
we have to switch to ILOCK_EXCL and relock.

This helps us avoid blowing lock assertions in things like generic/166:

XFS: Assertion failed: xfs_isilocked(ip, XFS_ILOCK_EXCL), file: fs/xfs/xfs_reflink.c, line: 383
WARNING: CPU: 1 PID: 24707 at fs/xfs/xfs_message.c:104 assfail+0x25/0x30 [xfs]
Modules linked in: deadline_iosched dm_snapshot dm_bufio ext4 mbcache jbd2 dm_flakey xfs libcrc32c dax_pmem device_dax nd_pmem sch_fq_codel af_packet [last unloaded: scsi_debug]
CPU: 1 PID: 24707 Comm: xfs_io Not tainted 4.18.0-rc1-djw #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.10.2-1ubuntu1 04/01/2014
RIP: 0010:assfail+0x25/0x30 [xfs]
Code: ff 0f 0b c3 90 66 66 66 66 90 48 89 f1 41 89 d0 48 c7 c6 e8 ef 1b a0 48 89 fa 31 ff e8 54 f9 ff ff 80 3d fd ba 0f 00 00 75 03 <0f> 0b c3 0f 0b 66 0f 1f 44 00 00 66 66 66 66 90 48 63 f6 49 89 f9
RSP: 0018:ffffc90006423ad8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff880030b65e80 RCX: 0000000000000000
RDX: 00000000ffffffc0 RSI: 000000000000000a RDI: ffffffffa01b0447
RBP: ffffc90006423c10 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88003d43fc30 R11: f000000000000000 R12: ffff880077cda000
R13: 0000000000000000 R14: ffffc90006423c30 R15: ffffc90006423bf9
FS:  00007feba8986800(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000138ab58 CR3: 000000003d40a000 CR4: 00000000000006a0
Call Trace:
 xfs_reflink_allocate_cow+0x24c/0x3d0 [xfs]
 xfs_file_iomap_begin+0x6d2/0xeb0 [xfs]
 ? iomap_to_fiemap+0x80/0x80
 iomap_apply+0x5e/0x130
 iomap_dio_rw+0x2e0/0x400
 ? iomap_to_fiemap+0x80/0x80
 ? xfs_file_dio_aio_write+0x133/0x4a0 [xfs]
 xfs_file_dio_aio_write+0x133/0x4a0 [xfs]
 xfs_file_write_iter+0x7b/0xb0 [xfs]
 __vfs_write+0x16f/0x1f0
 vfs_write+0xc8/0x1c0
 ksys_pwrite64+0x74/0x90
 do_syscall_64+0x56/0x180
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
---
 fs/xfs/xfs_iomap.c |   15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)


diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 49f5492eed3b..55876dd02f0c 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -963,12 +963,13 @@ xfs_ilock_for_iomap(
 	unsigned		*lockmode)
 {
 	unsigned		mode = XFS_ILOCK_SHARED;
+	bool			is_write = flags & (IOMAP_WRITE | IOMAP_ZERO);
 
 	/*
 	 * COW writes may allocate delalloc space or convert unwritten COW
 	 * extents, so we need to make sure to take the lock exclusively here.
 	 */
-	if (xfs_is_reflink_inode(ip) && (flags & (IOMAP_WRITE | IOMAP_ZERO))) {
+	if (xfs_is_reflink_inode(ip) && is_write) {
 		/*
 		 * FIXME: It could still overwrite on unshared extents and not
 		 * need allocation.
@@ -989,6 +990,7 @@ xfs_ilock_for_iomap(
 		mode = XFS_ILOCK_EXCL;
 	}
 
+relock:
 	if (flags & IOMAP_NOWAIT) {
 		if (!xfs_ilock_nowait(ip, mode))
 			return -EAGAIN;
@@ -996,6 +998,17 @@ xfs_ilock_for_iomap(
 		xfs_ilock(ip, mode);
 	}
 
+	/*
+	 * The reflink iflag could have changed since the earlier unlocked
+	 * check, so if we got ILOCK_SHARED for a write and but we're now a
+	 * reflink inode we have to switch to ILOCK_EXCL and relock.
+	 */
+	if (mode == XFS_ILOCK_SHARED && is_write && xfs_is_reflink_inode(ip)) {
+		xfs_iunlock(ip, mode);
+		mode = XFS_ILOCK_EXCL;
+		goto relock;
+	}
+
 	*lockmode = mode;
 	return 0;
 }