Btrfs fails desatrerous on fuzzy tests

Btrfs fails desatrerous on fuzzy tests

[Juergen Sauer]

[-- Attachment #1.1: Type: text/plain, Size: 662 bytes --]

Hi!
do you know this paper ?

http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016.pdf

It was rushing through the Linux press sites in Germany, see also [german]:

http://www.pro-linux.de/news/1/23449/fuzzy-test-f%C3%BCr-dateisysteme-vorgestellt.html

mit freundlichen Grüßen
Jürgen Sauer
-- 
Jürgen Sauer - automatiX GmbH,
+49-4209-4699, juergen.sauer@automatix.de
Geschäftsführer: Jürgen Sauer,
Gerichtstand: Amtsgericht Walsrode • HRB 120986
Ust-Id: DE191468481 • St.Nr.: 36/211/08000
GPG Public Key zur Signaturprüfung:
http://www.automatix.de/juergen_sauer_publickey.gpg


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: Btrfs fails desatrerous on fuzzy tests

[David Sterba]

On Tue, Apr 12, 2016 at 04:24:32PM +0200, Juergen Sauer wrote:
> Hi!
> do you know this paper ?
> 
> http://events.linuxfoundation.org/sites/events/files/slides/AFL%20filesystem%20fuzzing%2C%20Vault%202016.pdf

Yes. There were several bugreports resulting from the fuzzing, all fixed
in 4.5 and IIRC all of them happen during mount. Thus the awkwardly low
amount of time to trigger the bugs. The fuzzing suite is not yet
released and instrumenting all the code is not all trivial, but the
Oracle guys promised to do a release but at least we have the generated
images in the btrfs-progs testsuite.

I'm curious about this level of fuzzing as it can help to make the error
handling more robust, but we'll be never able to completely defend
against crafted images. For example we can detect a missing extent
mapping when looking for it, but we cannot distinguish that from an
existing but wrong mapping.  That would be like doing a full filesystem
integrity check all the time (because we cannot trust any data we read
from disk). There are exceptions where there's enough information cached
or available from other contexts, but overall too hard to fix. And this
applies to all filesystem.s