fstests.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] xfs: add test for CVE-2020-12655
@ 2020-06-19 13:44 Gao Xiang
  2020-06-23  2:04 ` [PATCH v2] " Gao Xiang
  0 siblings, 1 reply; 7+ messages in thread
From: Gao Xiang @ 2020-06-19 13:44 UTC (permalink / raw)
  To: fstests; +Cc: Gao Xiang

Add a regression test to see if kernel hangs in order to
look after CVE-2020-12655 and check if the corresponding
fix is applied as well.

Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
---
 tests/xfs/520     | 98 +++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/520.out |  2 +
 tests/xfs/group   |  1 +
 3 files changed, 101 insertions(+)
 create mode 100755 tests/xfs/520
 create mode 100644 tests/xfs/520.out

diff --git a/tests/xfs/520 b/tests/xfs/520
new file mode 100755
index 00000000..28354f8d
--- /dev/null
+++ b/tests/xfs/520
@@ -0,0 +1,98 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2020 Red Hat, Inc.  All Rights Reserved.
+#
+# FS QA Test 520
+#
+# Verify kernel doesn't hang when mounting a crafted image
+# with bad agf.freeblks metadata due to CVE-2020-12655.
+#
+# Also, check if
+# commit d0c7feaf8767 ("xfs: add agf freeblocks verify in xfs_agf_verify")
+# is included in the current kernel.
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+	_scratch_unmount
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+
+# remove previous $seqres.full before test
+rm -f $seqres.full
+
+# real QA test starts here
+
+# Modify as appropriate.
+_supported_fs xfs
+_supported_os Linux
+_disable_dmesg_check
+
+bigval=100000000
+fsdsopt="-d agcount=1,size=64m"
+
+_require_scratch
+_scratch_mkfs_xfs $fsdsopt >> $seqres.full 2>&1 || _fail "mkfs failed"
+
+# test if forcing agf.freeblks = 0 could cause the kernel livelock.
+_scratch_xfs_set_metadata_field freeblks 0 "agf 0" >> $seqres.full 2>&1
+if _try_scratch_mount >> $seqres.full 2>&1; then
+	echo potential broken kernel, try to reproduce the bug anyway
+	dd if=/dev/zero of=$SCRATCH_MNT/test bs=65536 count=1 >> $seqres.full 2>&1
+	sync
+	_scratch_unmount
+fi
+
+_scratch_mkfs_xfs -f $fsdsopt >> $seqres.full 2>&1 || _fail "mkfs failed"
+
+# test if forcing agf.longest = $bigval shouldn't be mounted.
+_scratch_xfs_set_metadata_field longest $bigval "agf 0" >> $seqres.full 2>&1
+_try_scratch_mount >> $seqres.full 2>&1 && \
+	_fail "potential broken kernel, mount should have failed"
+
+_scratch_mkfs_xfs -f $fsdsopt >> $seqres.full 2>&1 || _fail "mkfs failed"
+
+# test if forcing agf.length = $bigval shouldn't be mounted.
+_scratch_xfs_set_metadata_field length $bigval "agf 0" >> $seqres.full 2>&1
+_try_scratch_mount >> $seqres.full 2>&1 && \
+	_fail "potential broken kernel, mount should have failed"
+
+
+if _scratch_mkfs_xfs_supported -m reflink=1 >> $seqres.full 2>&1; then
+	_scratch_mkfs_xfs -f -m reflink=1 $fsdsopt >> $seqres.full 2>&1 || \
+		_fail "mkfs failed"
+
+	# test if forcing agf.refcntblocks = $bigval shouldn't be mounted.
+	_scratch_xfs_set_metadata_field refcntblocks $bigval "agf 0" >> $seqres.full 2>&1
+	_try_scratch_mount >> $seqres.full 2>&1 && \
+		_fail "potential broken kernel, mount should have failed"
+fi
+
+if _scratch_mkfs_xfs_supported -m rmapbt=1 >> $seqres.full 2>&1; then
+	_scratch_mkfs_xfs -f -m rmapbt=1 $fsdsopt >> $seqres.full 2>&1 || \
+		_fail "mkfs failed"
+
+	# test if forcing agf.rmapblocks = $bigval shouldn't be mounted.
+	_scratch_xfs_set_metadata_field rmapblocks $bigval "agf 0" >> $seqres.full 2>&1
+	_try_scratch_mount >> $seqres.full 2>&1 && \
+		_fail "potential broken kernel, mount should have failed"
+fi
+
+echo "Silence is golden"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/520.out b/tests/xfs/520.out
new file mode 100644
index 00000000..2a59b872
--- /dev/null
+++ b/tests/xfs/520.out
@@ -0,0 +1,2 @@
+QA output created by 520
+Silence is golden
diff --git a/tests/xfs/group b/tests/xfs/group
index daf54add..433f04d0 100644
--- a/tests/xfs/group
+++ b/tests/xfs/group
@@ -517,3 +517,4 @@
 517 auto quick fsmap freeze
 518 auto quick quota
 519 auto quick reflink
+520 auto quick reflink dangerous
-- 
2.18.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* [PATCH v2] xfs: add test for CVE-2020-12655
  2020-06-19 13:44 [PATCH] xfs: add test for CVE-2020-12655 Gao Xiang
@ 2020-06-23  2:04 ` Gao Xiang
  2020-06-23 15:23   ` Darrick J. Wong
  2020-06-24  1:06   ` [PATCH v3] " Gao Xiang
  0 siblings, 2 replies; 7+ messages in thread
From: Gao Xiang @ 2020-06-23  2:04 UTC (permalink / raw)
  To: fstests; +Cc: Gao Xiang

Add a regression test to see if kernel hangs in order to
look after CVE-2020-12655 and check if the corresponding
fix is applied as well.

Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
---
changes since v1:
 add "Metadata corruption" dmesg check as an auxiliary for specific kernel

 tests/xfs/520     | 87 +++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/520.out |  2 ++
 tests/xfs/group   |  1 +
 3 files changed, 90 insertions(+)
 create mode 100755 tests/xfs/520
 create mode 100644 tests/xfs/520.out

diff --git a/tests/xfs/520 b/tests/xfs/520
new file mode 100755
index 00000000..9e21579e
--- /dev/null
+++ b/tests/xfs/520
@@ -0,0 +1,87 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2020 Red Hat, Inc.  All Rights Reserved.
+#
+# FS QA Test 520
+#
+# Verify kernel doesn't hang when mounting a crafted image
+# with bad agf.freeblks metadata due to CVE-2020-12655.
+#
+# Also, check if
+# commit d0c7feaf8767 ("xfs: add agf freeblocks verify in xfs_agf_verify")
+# is included in the current kernel.
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+	_scratch_unmount > /dev/null 2>&1
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+
+# remove previous $seqres.full before test
+rm -f $seqres.full
+
+# real QA test starts here
+
+# Modify as appropriate.
+_supported_fs xfs
+_supported_os Linux
+_disable_dmesg_check
+_require_check_dmesg
+_require_scratch_nocheck
+
+force_crafted_metadata() {
+	_scratch_mkfs_xfs -f $fsdsopt "$4" >> $seqres.full 2>&1 || _fail "mkfs failed"
+	_scratch_xfs_set_metadata_field "$1" "$2" "$3" >> $seqres.full 2>&1
+	local kmsg="xfs/$seq: testing $1=$2 at $(date +"%F %T")"
+	local mounted=0
+	local hasmsg=0
+
+	echo "${kmsg}" > /dev/kmsg
+	_try_scratch_mount >> $seqres.full 2>&1 && mounted=1
+
+	if [ $mounted -ne 0 ]; then
+		dd if=/dev/zero of=$SCRATCH_MNT/test bs=65536 count=1 >> \
+			$seqres.full 2>&1
+		sync
+	fi
+
+	_dmesg_since_test_start | tac | sed -ne "0,\#${kmsg}#p" | tac | \
+		egrep -q 'Metadata corruption detected at' && hasmsg=1
+
+	_scratch_unmount > /dev/null 2>&1
+	[ $mounted -eq 0 -o $hasmsg -eq 1 ] && return
+	_fail "potential broken kernel"
+}
+
+bigval=100000000
+fsdsopt="-d agcount=1,size=64m"
+
+force_crafted_metadata freeblks 0 "agf 0"
+force_crafted_metadata longest $bigval "agf 0"
+force_crafted_metadata length $bigval "agf 0"
+
+_scratch_mkfs_xfs_supported -m reflink=1 >> $seqres.full 2>&1 && \
+	force_crafted_metadata refcntblocks $bigval "agf 0" "-m reflink=1"
+
+_scratch_mkfs_xfs_supported -m rmapbt=1 >> $seqres.full 2>&1 && \
+	force_crafted_metadata rmapblocks $bigval "agf 0" "-m rmapbt=1"
+
+echo "Silence is golden"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/520.out b/tests/xfs/520.out
new file mode 100644
index 00000000..2a59b872
--- /dev/null
+++ b/tests/xfs/520.out
@@ -0,0 +1,2 @@
+QA output created by 520
+Silence is golden
diff --git a/tests/xfs/group b/tests/xfs/group
index daf54add..433f04d0 100644
--- a/tests/xfs/group
+++ b/tests/xfs/group
@@ -517,3 +517,4 @@
 517 auto quick fsmap freeze
 518 auto quick quota
 519 auto quick reflink
+520 auto quick reflink dangerous
-- 
2.18.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH v2] xfs: add test for CVE-2020-12655
  2020-06-23  2:04 ` [PATCH v2] " Gao Xiang
@ 2020-06-23 15:23   ` Darrick J. Wong
  2020-06-23 15:30     ` Gao Xiang
  2020-06-24  1:06   ` [PATCH v3] " Gao Xiang
  1 sibling, 1 reply; 7+ messages in thread
From: Darrick J. Wong @ 2020-06-23 15:23 UTC (permalink / raw)
  To: Gao Xiang; +Cc: fstests

On Tue, Jun 23, 2020 at 10:04:47AM +0800, Gao Xiang wrote:
> Add a regression test to see if kernel hangs in order to
> look after CVE-2020-12655 and check if the corresponding
> fix is applied as well.
> 
> Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
> ---
> changes since v1:
>  add "Metadata corruption" dmesg check as an auxiliary for specific kernel
> 
>  tests/xfs/520     | 87 +++++++++++++++++++++++++++++++++++++++++++++++
>  tests/xfs/520.out |  2 ++
>  tests/xfs/group   |  1 +
>  3 files changed, 90 insertions(+)
>  create mode 100755 tests/xfs/520
>  create mode 100644 tests/xfs/520.out
> 
> diff --git a/tests/xfs/520 b/tests/xfs/520
> new file mode 100755
> index 00000000..9e21579e
> --- /dev/null
> +++ b/tests/xfs/520
> @@ -0,0 +1,87 @@
> +#! /bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +# Copyright (c) 2020 Red Hat, Inc.  All Rights Reserved.
> +#
> +# FS QA Test 520
> +#
> +# Verify kernel doesn't hang when mounting a crafted image
> +# with bad agf.freeblks metadata due to CVE-2020-12655.
> +#
> +# Also, check if
> +# commit d0c7feaf8767 ("xfs: add agf freeblocks verify in xfs_agf_verify")
> +# is included in the current kernel.
> +#
> +seq=`basename $0`
> +seqres=$RESULT_DIR/$seq
> +echo "QA output created by $seq"
> +
> +here=`pwd`
> +tmp=/tmp/$$
> +status=1	# failure is the default!
> +trap "_cleanup; exit \$status" 0 1 2 3 15
> +
> +_cleanup()
> +{
> +	cd /
> +	rm -f $tmp.*
> +	_scratch_unmount > /dev/null 2>&1
> +}
> +
> +# get standard environment, filters and checks
> +. ./common/rc
> +. ./common/filter
> +
> +# remove previous $seqres.full before test
> +rm -f $seqres.full
> +
> +# real QA test starts here
> +
> +# Modify as appropriate.
> +_supported_fs xfs
> +_supported_os Linux
> +_disable_dmesg_check
> +_require_check_dmesg
> +_require_scratch_nocheck
> +
> +force_crafted_metadata() {
> +	_scratch_mkfs_xfs -f $fsdsopt "$4" >> $seqres.full 2>&1 || _fail "mkfs failed"
> +	_scratch_xfs_set_metadata_field "$1" "$2" "$3" >> $seqres.full 2>&1
> +	local kmsg="xfs/$seq: testing $1=$2 at $(date +"%F %T")"
> +	local mounted=0
> +	local hasmsg=0
> +
> +	echo "${kmsg}" > /dev/kmsg
> +	_try_scratch_mount >> $seqres.full 2>&1 && mounted=1
> +
> +	if [ $mounted -ne 0 ]; then
> +		dd if=/dev/zero of=$SCRATCH_MNT/test bs=65536 count=1 >> \
> +			$seqres.full 2>&1
> +		sync
> +	fi
> +
> +	_dmesg_since_test_start | tac | sed -ne "0,\#${kmsg}#p" | tac | \
> +		egrep -q 'Metadata corruption detected at' && hasmsg=1
> +
> +	_scratch_unmount > /dev/null 2>&1
> +	[ $mounted -eq 0 -o $hasmsg -eq 1 ] && return
> +	_fail "potential broken kernel"

Could you print both variables in the error message so that it's easier
to figure out where exactly we went wrong?

> +}
> +
> +bigval=100000000
> +fsdsopt="-d agcount=1,size=64m"
> +
> +force_crafted_metadata freeblks 0 "agf 0"
> +force_crafted_metadata longest $bigval "agf 0"
> +force_crafted_metadata length $bigval "agf 0"
> +
> +_scratch_mkfs_xfs_supported -m reflink=1 >> $seqres.full 2>&1 && \
> +	force_crafted_metadata refcntblocks $bigval "agf 0" "-m reflink=1"
> +
> +_scratch_mkfs_xfs_supported -m rmapbt=1 >> $seqres.full 2>&1 && \
> +	force_crafted_metadata rmapblocks $bigval "agf 0" "-m rmapbt=1"
> +
> +echo "Silence is golden"
> +
> +# success, all done
> +status=0
> +exit
> diff --git a/tests/xfs/520.out b/tests/xfs/520.out
> new file mode 100644
> index 00000000..2a59b872
> --- /dev/null
> +++ b/tests/xfs/520.out
> @@ -0,0 +1,2 @@
> +QA output created by 520
> +Silence is golden
> diff --git a/tests/xfs/group b/tests/xfs/group
> index daf54add..433f04d0 100644
> --- a/tests/xfs/group
> +++ b/tests/xfs/group
> @@ -517,3 +517,4 @@
>  517 auto quick fsmap freeze
>  518 auto quick quota
>  519 auto quick reflink
> +520 auto quick reflink dangerous

Hmmm... I guess the fix has been out for a while, so it's less shocking
to put a dangerous test in the auto group?

--D

> -- 
> 2.18.1
> 

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH v2] xfs: add test for CVE-2020-12655
  2020-06-23 15:23   ` Darrick J. Wong
@ 2020-06-23 15:30     ` Gao Xiang
  0 siblings, 0 replies; 7+ messages in thread
From: Gao Xiang @ 2020-06-23 15:30 UTC (permalink / raw)
  To: Darrick J. Wong; +Cc: fstests

Hi Darrick,

On Tue, Jun 23, 2020 at 08:23:52AM -0700, Darrick J. Wong wrote:

...

> > +
> > +	_scratch_unmount > /dev/null 2>&1
> > +	[ $mounted -eq 0 -o $hasmsg -eq 1 ] && return
> > +	_fail "potential broken kernel"
> 
> Could you print both variables in the error message so that it's easier
> to figure out where exactly we went wrong?

Okay, will fix in the next version (tomorrow, about to sleep...)

> 

...

> >  518 auto quick quota
> >  519 auto quick reflink
> > +520 auto quick reflink dangerous
> 
> Hmmm... I guess the fix has been out for a while, so it's less shocking
> to put a dangerous test in the auto group?

Okay, will update it (I'm backporting the fix to old old kernels...
and some you know....). Thanks for the review!

Thanks,
Gao Xiang

> 
> --D
> 
> > -- 
> > 2.18.1
> > 
> 


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH v3] xfs: add test for CVE-2020-12655
  2020-06-23  2:04 ` [PATCH v2] " Gao Xiang
  2020-06-23 15:23   ` Darrick J. Wong
@ 2020-06-24  1:06   ` Gao Xiang
  2020-06-24 15:18     ` Darrick J. Wong
  1 sibling, 1 reply; 7+ messages in thread
From: Gao Xiang @ 2020-06-24  1:06 UTC (permalink / raw)
  To: fstests; +Cc: Darrick J. Wong, Gao Xiang

Add a regression test to see if kernel hangs in order to
look after CVE-2020-12655 and check if the corresponding
fix is applied as well.

Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
---
changes since v2:
 - print mounted, hasmsg out if fails (Darrick);

 - remove dangerous group since the fix has been
   in kernel for a while (Darrick)

 tests/xfs/520     | 86 +++++++++++++++++++++++++++++++++++++++++++++++
 tests/xfs/520.out |  2 ++
 tests/xfs/group   |  1 +
 3 files changed, 89 insertions(+)
 create mode 100755 tests/xfs/520
 create mode 100644 tests/xfs/520.out

diff --git a/tests/xfs/520 b/tests/xfs/520
new file mode 100755
index 00000000..bdc05f7a
--- /dev/null
+++ b/tests/xfs/520
@@ -0,0 +1,86 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2020 Red Hat, Inc.  All Rights Reserved.
+#
+# FS QA Test 520
+#
+# Verify kernel doesn't hang when mounting a crafted image
+# with bad agf.freeblks metadata due to CVE-2020-12655.
+#
+# Also, check if
+# commit d0c7feaf8767 ("xfs: add agf freeblocks verify in xfs_agf_verify")
+# is included in the current kernel.
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+	_scratch_unmount > /dev/null 2>&1
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/filter
+
+# remove previous $seqres.full before test
+rm -f $seqres.full
+
+# real QA test starts here
+
+_supported_fs xfs
+_supported_os Linux
+_disable_dmesg_check
+_require_check_dmesg
+_require_scratch_nocheck
+
+force_crafted_metadata() {
+	_scratch_mkfs_xfs -f $fsdsopt "$4" >> $seqres.full 2>&1 || _fail "mkfs failed"
+	_scratch_xfs_set_metadata_field "$1" "$2" "$3" >> $seqres.full 2>&1
+	local kmsg="xfs/$seq: testing $1=$2 at $(date +"%F %T")"
+	local mounted=0
+	local hasmsg=0
+
+	echo "${kmsg}" > /dev/kmsg
+	_try_scratch_mount >> $seqres.full 2>&1 && mounted=1
+
+	if [ $mounted -ne 0 ]; then
+		dd if=/dev/zero of=$SCRATCH_MNT/test bs=65536 count=1 >> \
+			$seqres.full 2>&1
+		sync
+	fi
+
+	_dmesg_since_test_start | tac | sed -ne "0,\#${kmsg}#p" | tac | \
+		egrep -q 'Metadata corruption detected at' && hasmsg=1
+
+	_scratch_unmount > /dev/null 2>&1
+	[ $mounted -eq 0 -o $hasmsg -eq 1 ] || \
+		_fail "potential broken kernel (mounted=${mounted},hasmsg=${hasmsg})"
+}
+
+bigval=100000000
+fsdsopt="-d agcount=1,size=64m"
+
+force_crafted_metadata freeblks 0 "agf 0"
+force_crafted_metadata longest $bigval "agf 0"
+force_crafted_metadata length $bigval "agf 0"
+
+_scratch_mkfs_xfs_supported -m reflink=1 >> $seqres.full 2>&1 && \
+	force_crafted_metadata refcntblocks $bigval "agf 0" "-m reflink=1"
+
+_scratch_mkfs_xfs_supported -m rmapbt=1 >> $seqres.full 2>&1 && \
+	force_crafted_metadata rmapblocks $bigval "agf 0" "-m rmapbt=1"
+
+echo "Silence is golden"
+
+# success, all done
+status=0
+exit
diff --git a/tests/xfs/520.out b/tests/xfs/520.out
new file mode 100644
index 00000000..2a59b872
--- /dev/null
+++ b/tests/xfs/520.out
@@ -0,0 +1,2 @@
+QA output created by 520
+Silence is golden
diff --git a/tests/xfs/group b/tests/xfs/group
index daf54add..d6e8d1c3 100644
--- a/tests/xfs/group
+++ b/tests/xfs/group
@@ -517,3 +517,4 @@
 517 auto quick fsmap freeze
 518 auto quick quota
 519 auto quick reflink
+520 auto quick reflink
-- 
2.18.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH v3] xfs: add test for CVE-2020-12655
  2020-06-24  1:06   ` [PATCH v3] " Gao Xiang
@ 2020-06-24 15:18     ` Darrick J. Wong
  2020-06-25  3:15       ` Gao Xiang
  0 siblings, 1 reply; 7+ messages in thread
From: Darrick J. Wong @ 2020-06-24 15:18 UTC (permalink / raw)
  To: Gao Xiang; +Cc: fstests

On Wed, Jun 24, 2020 at 09:06:30AM +0800, Gao Xiang wrote:
> Add a regression test to see if kernel hangs in order to
> look after CVE-2020-12655 and check if the corresponding
> fix is applied as well.
> 
> Signed-off-by: Gao Xiang <hsiangkao@redhat.com>
> ---
> changes since v2:
>  - print mounted, hasmsg out if fails (Darrick);
> 
>  - remove dangerous group since the fix has been
>    in kernel for a while (Darrick)
> 
>  tests/xfs/520     | 86 +++++++++++++++++++++++++++++++++++++++++++++++
>  tests/xfs/520.out |  2 ++
>  tests/xfs/group   |  1 +
>  3 files changed, 89 insertions(+)
>  create mode 100755 tests/xfs/520
>  create mode 100644 tests/xfs/520.out
> 
> diff --git a/tests/xfs/520 b/tests/xfs/520
> new file mode 100755
> index 00000000..bdc05f7a
> --- /dev/null
> +++ b/tests/xfs/520
> @@ -0,0 +1,86 @@
> +#! /bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +# Copyright (c) 2020 Red Hat, Inc.  All Rights Reserved.
> +#
> +# FS QA Test 520
> +#
> +# Verify kernel doesn't hang when mounting a crafted image
> +# with bad agf.freeblks metadata due to CVE-2020-12655.
> +#
> +# Also, check if
> +# commit d0c7feaf8767 ("xfs: add agf freeblocks verify in xfs_agf_verify")
> +# is included in the current kernel.
> +#
> +seq=`basename $0`
> +seqres=$RESULT_DIR/$seq
> +echo "QA output created by $seq"
> +
> +here=`pwd`
> +tmp=/tmp/$$
> +status=1	# failure is the default!
> +trap "_cleanup; exit \$status" 0 1 2 3 15
> +
> +_cleanup()
> +{
> +	cd /
> +	rm -f $tmp.*
> +	_scratch_unmount > /dev/null 2>&1
> +}
> +
> +# get standard environment, filters and checks
> +. ./common/rc
> +. ./common/filter
> +
> +# remove previous $seqres.full before test
> +rm -f $seqres.full
> +
> +# real QA test starts here
> +
> +_supported_fs xfs
> +_supported_os Linux
> +_disable_dmesg_check
> +_require_check_dmesg
> +_require_scratch_nocheck
> +
> +force_crafted_metadata() {
> +	_scratch_mkfs_xfs -f $fsdsopt "$4" >> $seqres.full 2>&1 || _fail "mkfs failed"
> +	_scratch_xfs_set_metadata_field "$1" "$2" "$3" >> $seqres.full 2>&1
> +	local kmsg="xfs/$seq: testing $1=$2 at $(date +"%F %T")"
> +	local mounted=0
> +	local hasmsg=0
> +
> +	echo "${kmsg}" > /dev/kmsg
> +	_try_scratch_mount >> $seqres.full 2>&1 && mounted=1
> +
> +	if [ $mounted -ne 0 ]; then
> +		dd if=/dev/zero of=$SCRATCH_MNT/test bs=65536 count=1 >> \
> +			$seqres.full 2>&1

Just FYI we conventionally use:

$XFS_IO_PROG -f -c 'pwrite 0 64k' $SCRATCH_MNT/test >> $seqres.full

to create files in fstests with less typing, but no need to reroll this
whole thing just for that.

> +		sync
> +	fi
> +
> +	_dmesg_since_test_start | tac | sed -ne "0,\#${kmsg}#p" | tac | \
> +		egrep -q 'Metadata corruption detected at' && hasmsg=1
> +
> +	_scratch_unmount > /dev/null 2>&1
> +	[ $mounted -eq 0 -o $hasmsg -eq 1 ] || \
> +		_fail "potential broken kernel (mounted=${mounted},hasmsg=${hasmsg})"
> +}
> +
> +bigval=100000000
> +fsdsopt="-d agcount=1,size=64m"
> +
> +force_crafted_metadata freeblks 0 "agf 0"
> +force_crafted_metadata longest $bigval "agf 0"
> +force_crafted_metadata length $bigval "agf 0"
> +
> +_scratch_mkfs_xfs_supported -m reflink=1 >> $seqres.full 2>&1 && \
> +	force_crafted_metadata refcntblocks $bigval "agf 0" "-m reflink=1"
> +
> +_scratch_mkfs_xfs_supported -m rmapbt=1 >> $seqres.full 2>&1 && \
> +	force_crafted_metadata rmapblocks $bigval "agf 0" "-m rmapbt=1"
> +
> +echo "Silence is golden"
> +
> +# success, all done
> +status=0
> +exit
> diff --git a/tests/xfs/520.out b/tests/xfs/520.out
> new file mode 100644
> index 00000000..2a59b872
> --- /dev/null
> +++ b/tests/xfs/520.out
> @@ -0,0 +1,2 @@
> +QA output created by 520
> +Silence is golden
> diff --git a/tests/xfs/group b/tests/xfs/group
> index daf54add..d6e8d1c3 100644
> --- a/tests/xfs/group
> +++ b/tests/xfs/group
> @@ -517,3 +517,4 @@
>  517 auto quick fsmap freeze
>  518 auto quick quota
>  519 auto quick reflink
> +520 auto quick reflink

Er... this will hang unpatched kernels, right?  Tests that are known to
do that probably ought to have /some/ warning about that.  Oh, I guess
you do warn about that in the test comment itself.  Ok, good enough
for me.

Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>

--D

> -- 
> 2.18.1
> 

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH v3] xfs: add test for CVE-2020-12655
  2020-06-24 15:18     ` Darrick J. Wong
@ 2020-06-25  3:15       ` Gao Xiang
  0 siblings, 0 replies; 7+ messages in thread
From: Gao Xiang @ 2020-06-25  3:15 UTC (permalink / raw)
  To: Darrick J. Wong; +Cc: fstests

On Wed, Jun 24, 2020 at 08:18:54AM -0700, Darrick J. Wong wrote:

...

> > +			$seqres.full 2>&1
> 
> Just FYI we conventionally use:
> 
> $XFS_IO_PROG -f -c 'pwrite 0 64k' $SCRATCH_MNT/test >> $seqres.full
> 
> to create files in fstests with less typing, but no need to reroll this
> whole thing just for that.

Okay, hope Eryu could update this when applying.
(anyway I could resend quickly if needed...)

Thanks,
Gao Xiang


^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2020-06-25  3:15 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-19 13:44 [PATCH] xfs: add test for CVE-2020-12655 Gao Xiang
2020-06-23  2:04 ` [PATCH v2] " Gao Xiang
2020-06-23 15:23   ` Darrick J. Wong
2020-06-23 15:30     ` Gao Xiang
2020-06-24  1:06   ` [PATCH v3] " Gao Xiang
2020-06-24 15:18     ` Darrick J. Wong
2020-06-25  3:15       ` Gao Xiang

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).