linux-xfs.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Darrick J. Wong" <darrick.wong@oracle.com>
To: david@fromorbit.com, eguan@redhat.com, darrick.wong@oracle.com
Cc: linux-xfs@vger.kernel.org, fstests@vger.kernel.org
Subject: [PATCH v3 00/11] xfstests: online scrub/repair support
Date: Tue, 06 Dec 2016 16:18:11 -0800	[thread overview]
Message-ID: <148106989109.19334.6839386416313318071.stgit@birch.djwong.org> (raw)

Hi all,

This is the third revision of a patchset that adds to XFS userland
tools support for online metadata scrubbing and repair.

The first patch tests ocfs2's ability to handle reflink when there are
inline-data files.

The second patch maliciously corrupts ext4 and xfs filesystems to
exploit nonexistent checking of i_size in order to coerce Linux into
loading a file with negative size.  It then exploits integer overflows
in the VFS writeback code to hard lock the kernel.

** DO NOT RUN THESE TESTS UNLESS YOU HAVE APPLIED THIS PATCH: **
"vfs: reject inodes with negative size to prevent kernel hang"

---------------

The new patches in this series do three things: first, they expand the
filesystem populate commands inside xfstests to be able to create all
types of XFS metadata.  Second, they create a bunch of xfs_db wrapper
functions to iterate all fields present in a given metadata object and
fuzz them in various ways.  Finally, for each metadata object type there
is a separate test that iteratively fuzzes all fields of that object
and runs it through the mount/scrub/repair loop to see what happens.

If you're going to start using this mess, you probably ought to just
pull from my github trees for kernel[1], xfsprogs[2], and xfstests[3].
The kernel patches in the git trees should apply to 4.9-rc8; xfsprogs
patches to for-next; and xfstest to master.

The patches have survived all auto group xfstests both with scrub-only
mode and also a special debugging mode to xfs_scrub that forces it to
rebuild the metadata structures even if they're not damaged.  Note that
I haven't thoroughly run the new tests in [3] that try to fuzz every
field in every data structure on disk.

This is an extraordinary way to eat your data.  Enjoy! 
Comments and questions are, as always, welcome.

--D

[1] https://github.com/djwong/linux/tree/djwong-devel
[2] https://github.com/djwong/xfsprogs/tree/djwong-devel
[3] https://github.com/djwong/xfstests/tree/djwong-devel

             reply	other threads:[~2016-12-07  0:18 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-12-07  0:18 Darrick J. Wong [this message]
2016-12-07  0:18 ` [PATCH 01/11] ocfs2: test reflinking to inline data files Darrick J. Wong
2016-12-07  0:18 ` [PATCH 02/11] xfs/ext4: check negative inode size Darrick J. Wong
2016-12-07  0:18 ` [PATCH 03/11] populate: create all types of XFS metadata Darrick J. Wong
2016-12-07  0:18 ` [PATCH 04/11] populate: add _require_populate_commands to check for tools Darrick J. Wong
2016-12-07  0:18 ` [PATCH 05/11] populate: optionally fill the filesystem when populating fs Darrick J. Wong
2016-12-07  0:18 ` [PATCH 06/11] populate: fix some silly errors when modifying a fs while fuzzing Darrick J. Wong
2016-12-07  0:18 ` [PATCH 07/11] common/fuzzy: move fuzzing helper functions here Darrick J. Wong
2016-12-07  0:19 ` [PATCH 08/11] populate: cache scratch metadata images Darrick J. Wong
2016-12-07  0:19 ` [PATCH 09/11] populate: discover XFS structure fields and fuzz verbs, and use them to fuzz fields Darrick J. Wong
2016-12-07  0:19 ` [PATCH 10/11] common/populate: create attrs in different namespaces Darrick J. Wong
2016-12-07  0:19 ` [PATCH 11/11] xfs: fuzz every field of every structure Darrick J. Wong

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=148106989109.19334.6839386416313318071.stgit@birch.djwong.org \
    --to=darrick.wong@oracle.com \
    --cc=david@fromorbit.com \
    --cc=eguan@redhat.com \
    --cc=fstests@vger.kernel.org \
    --cc=linux-xfs@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).