All of lore.kernel.org
 help / color / mirror / Atom feed
From: Hou Tao <houtao1@huawei.com>
To: <guaneryu@gmail.com>, <richard@nod.at>, <yuchao0@huawei.com>
Cc: <fstests@vger.kernel.org>
Subject: [PATCH v2 1/2] generic: add test for race between listxattr and setxatr
Date: Sat, 22 Aug 2020 19:41:32 +0800	[thread overview]
Message-ID: <20200822114132.61227-1-houtao1@huawei.com> (raw)
In-Reply-To: <364596a1-c9bb-3a10-a132-0f43907c2241@huawei.com>

Add reproducer for a bug on ubifs where listxattr() copies
the newly created xattr names regardless of the remaining
buffer size, fails the assertion of used buffer size,
and may corrupt buffer memory.

Signed-off-by: Hou Tao <houtao1@huawei.com>
---
v2: accommodate f2fs by reducing the number of created xattrs for f2fs

 tests/generic/998     | 67 +++++++++++++++++++++++++++++++++++++++++++
 tests/generic/998.out |  2 ++
 tests/generic/group   |  1 +
 3 files changed, 70 insertions(+)
 create mode 100644 tests/generic/998
 create mode 100644 tests/generic/998.out

diff --git a/tests/generic/998 b/tests/generic/998
new file mode 100644
index 00000000..26a5b620
--- /dev/null
+++ b/tests/generic/998
@@ -0,0 +1,67 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2020 Huawei. All Rights Reserved.
+#
+# FS QA Test 998
+#
+# Test race between listxattr() and setxattr(). It reproduces a bug
+# on UBIFS where listxattr() copies the newly created xattr names
+# regardless of the remaining buffer size, fails the assertion of
+# used buffer size, and may corrupt buffer memory.
+#
+seq=`basename $0`
+seqres=$RESULT_DIR/$seq
+echo "QA output created by $seq"
+
+here=`pwd`
+tmp=/tmp/$$
+status=1	# failure is the default!
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+_cleanup()
+{
+	cd /
+	rm -f $tmp.*
+	rm -f $TEST_DIR/$seq
+}
+
+# get standard environment, filters and checks
+. ./common/rc
+. ./common/attr
+
+# remove previous $seqres.full before test
+rm -f $seqres.full
+
+# real QA test starts here
+_supported_fs generic
+_supported_os Linux
+_require_attrs
+
+target=$TEST_DIR/$seq
+touch $target
+
+# start a background listxattr
+runfile="$tmp.listxattr"
+touch $runfile
+while [ -e $runfile ]; do
+	${GETFATTR_PROG} $target >/dev/null 2>&1
+done &
+
+# add new xattr continuously
+largename=`for i in $(seq 0 128); do echo -n a; done`
+cnt=100
+# f2fs has limited spaces for xattr
+[ $FSTYP == "f2fs" ] && cnt=30
+for i in $(seq 1 $cnt); do
+	${SETFATTR_PROG} -n user.${largename}.$i -v $i $target
+done
+
+rm -f $runfile
+wait > /dev/null 2>&1
+rm -f $target
+
+echo Silence is golden
+
+# success, all done
+status=0
+exit
diff --git a/tests/generic/998.out b/tests/generic/998.out
new file mode 100644
index 00000000..d2679ae0
--- /dev/null
+++ b/tests/generic/998.out
@@ -0,0 +1,2 @@
+QA output created by 998
+Silence is golden
diff --git a/tests/generic/group b/tests/generic/group
index d9ab9a31..62697ac5 100644
--- a/tests/generic/group
+++ b/tests/generic/group
@@ -605,3 +605,4 @@
 600 auto quick quota
 601 auto quick quota
 602 auto quick encrypt
+998 auto quick attr
-- 
2.25.0.4.g0ad7144999


  reply	other threads:[~2020-08-22 11:34 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-17  8:44 [PATCH 0/2] add tests for race between xattr read and write Hou Tao
2020-07-17  8:44 ` [PATCH 1/2] generic: add test for race between listxattr and setxatr Hou Tao
2020-07-20  3:40   ` Chao Yu
2020-08-22 11:41     ` Hou Tao [this message]
2020-08-30 16:23       ` [PATCH v2 " Eryu Guan
2020-08-31  1:19         ` Chao Yu
2020-08-31  3:01         ` Hou Tao
2020-09-02 15:48           ` Eryu Guan
2020-09-02 16:43       ` Darrick J. Wong
2020-07-17  8:44 ` [PATCH 2/2] generic: add test for race between getxattr and setxattr Hou Tao

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200822114132.61227-1-houtao1@huawei.com \
    --to=houtao1@huawei.com \
    --cc=fstests@vger.kernel.org \
    --cc=guaneryu@gmail.com \
    --cc=richard@nod.at \
    --cc=yuchao0@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.