From: "Darrick J. Wong" <darrick.wong@oracle.com>
To: Hou Tao <houtao1@huawei.com>
Cc: guaneryu@gmail.com, richard@nod.at, yuchao0@huawei.com,
fstests@vger.kernel.org
Subject: Re: [PATCH v2 1/2] generic: add test for race between listxattr and setxatr
Date: Wed, 2 Sep 2020 09:43:45 -0700 [thread overview]
Message-ID: <20200902164345.GD191798@magnolia> (raw)
In-Reply-To: <20200822114132.61227-1-houtao1@huawei.com>
On Sat, Aug 22, 2020 at 07:41:32PM +0800, Hou Tao wrote:
> Add reproducer for a bug on ubifs where listxattr() copies
> the newly created xattr names regardless of the remaining
> buffer size, fails the assertion of used buffer size,
> and may corrupt buffer memory.
>
> Signed-off-by: Hou Tao <houtao1@huawei.com>
> ---
> v2: accommodate f2fs by reducing the number of created xattrs for f2fs
>
> tests/generic/998 | 67 +++++++++++++++++++++++++++++++++++++++++++
> tests/generic/998.out | 2 ++
> tests/generic/group | 1 +
> 3 files changed, 70 insertions(+)
> create mode 100644 tests/generic/998
> create mode 100644 tests/generic/998.out
>
> diff --git a/tests/generic/998 b/tests/generic/998
> new file mode 100644
> index 00000000..26a5b620
> --- /dev/null
> +++ b/tests/generic/998
> @@ -0,0 +1,67 @@
> +#! /bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +# Copyright (c) 2020 Huawei. All Rights Reserved.
> +#
> +# FS QA Test 998
> +#
> +# Test race between listxattr() and setxattr(). It reproduces a bug
> +# on UBIFS where listxattr() copies the newly created xattr names
> +# regardless of the remaining buffer size, fails the assertion of
> +# used buffer size, and may corrupt buffer memory.
> +#
> +seq=`basename $0`
> +seqres=$RESULT_DIR/$seq
> +echo "QA output created by $seq"
> +
> +here=`pwd`
> +tmp=/tmp/$$
> +status=1 # failure is the default!
> +trap "_cleanup; exit \$status" 0 1 2 3 15
> +
> +_cleanup()
> +{
> + cd /
> + rm -f $tmp.*
> + rm -f $TEST_DIR/$seq
> +}
> +
> +# get standard environment, filters and checks
> +. ./common/rc
> +. ./common/attr
> +
> +# remove previous $seqres.full before test
> +rm -f $seqres.full
> +
> +# real QA test starts here
> +_supported_fs generic
> +_supported_os Linux
> +_require_attrs
> +
> +target=$TEST_DIR/$seq
> +touch $target
> +
> +# start a background listxattr
> +runfile="$tmp.listxattr"
> +touch $runfile
> +while [ -e $runfile ]; do
> + ${GETFATTR_PROG} $target >/dev/null 2>&1
Er, if the listxattr corrupts the buffer memory, how does this test
detect that? Does the kernel crash or something?
> +done &
> +
> +# add new xattr continuously
> +largename=`for i in $(seq 0 128); do echo -n a; done`
> +cnt=100
> +# f2fs has limited spaces for xattr
> +[ $FSTYP == "f2fs" ] && cnt=30
> +for i in $(seq 1 $cnt); do
> + ${SETFATTR_PROG} -n user.${largename}.$i -v $i $target
Seeing as each filesystem has different xattr limits, I wonder if
instead of special casing of f2fs we ought to capture the
stdout/stderr of SETFATTR_PROG and filter out the ENOSPC message?
AFAICT this test isn't trying to check that setting xattrs succeeds, but
I'm a little confused on how we detect the corrupted buffer...
--D
> +done
> +
> +rm -f $runfile
> +wait > /dev/null 2>&1
> +rm -f $target
> +
> +echo Silence is golden
> +
> +# success, all done
> +status=0
> +exit
> diff --git a/tests/generic/998.out b/tests/generic/998.out
> new file mode 100644
> index 00000000..d2679ae0
> --- /dev/null
> +++ b/tests/generic/998.out
> @@ -0,0 +1,2 @@
> +QA output created by 998
> +Silence is golden
> diff --git a/tests/generic/group b/tests/generic/group
> index d9ab9a31..62697ac5 100644
> --- a/tests/generic/group
> +++ b/tests/generic/group
> @@ -605,3 +605,4 @@
> 600 auto quick quota
> 601 auto quick quota
> 602 auto quick encrypt
> +998 auto quick attr
> --
> 2.25.0.4.g0ad7144999
>
next prev parent reply other threads:[~2020-09-02 16:44 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-17 8:44 [PATCH 0/2] add tests for race between xattr read and write Hou Tao
2020-07-17 8:44 ` [PATCH 1/2] generic: add test for race between listxattr and setxatr Hou Tao
2020-07-20 3:40 ` Chao Yu
2020-08-22 11:41 ` [PATCH v2 " Hou Tao
2020-08-30 16:23 ` Eryu Guan
2020-08-31 1:19 ` Chao Yu
2020-08-31 3:01 ` Hou Tao
2020-09-02 15:48 ` Eryu Guan
2020-09-02 16:43 ` Darrick J. Wong [this message]
2020-07-17 8:44 ` [PATCH 2/2] generic: add test for race between getxattr and setxattr Hou Tao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200902164345.GD191798@magnolia \
--to=darrick.wong@oracle.com \
--cc=fstests@vger.kernel.org \
--cc=guaneryu@gmail.com \
--cc=houtao1@huawei.com \
--cc=richard@nod.at \
--cc=yuchao0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).