From patchwork Fri Sep 22 02:34:46 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Wareing X-Patchwork-Id: 9965047 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 318FA602D8 for ; Fri, 22 Sep 2017 02:34:52 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2001F296D2 for ; Fri, 22 Sep 2017 02:34:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 14D75296D5; Fri, 22 Sep 2017 02:34:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 59BD0296D2 for ; Fri, 22 Sep 2017 02:34:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751791AbdIVCet (ORCPT ); Thu, 21 Sep 2017 22:34:49 -0400 Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:38880 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751780AbdIVCes (ORCPT ); Thu, 21 Sep 2017 22:34:48 -0400 Received: from pps.filterd (m0001303.ppops.net [127.0.0.1]) by m0001303.ppops.net (8.16.0.21/8.16.0.21) with SMTP id v8M2W0ZY016280 for ; Thu, 21 Sep 2017 19:34:47 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fb.com; h=from : to : cc : subject : date : message-id : mime-version : content-type; s=facebook; bh=5mPAIxcwS89Pn0N1kKVBP+ZuiU+6XDYzgvczd5isAeU=; b=aTleXlc7LrXNmR3pLakn/5HbSex9yaISpfj1gvxsRzdr6nQSCJYiRxduo9kRuruM/nk/ JBu5Kh0GOwP8UEn20r92Ho2/gIyjaBBaOdim0D2Vz1qa2KNj1fvLJNIrTe8ngoPglWTC j0yyd6R1ow+Y7W8ct77FKnGC5gIDgm2VQXk= Received: from mail.thefacebook.com ([199.201.64.23]) by m0001303.ppops.net with ESMTP id 2d4s5604m1-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Thu, 21 Sep 2017 19:34:47 -0700 Received: from mx-out.facebook.com (192.168.52.123) by PRN-CHUB04.TheFacebook.com (192.168.16.14) with Microsoft SMTP Server id 14.3.319.2; Thu, 21 Sep 2017 19:34:46 -0700 Received: from devbig279.prn1.facebook.com (localhost [127.0.0.1]) by devbig279.prn1.facebook.com (Postfix) with ESMTP id 7ECDB362071A; Thu, 21 Sep 2017 19:34:46 -0700 (PDT) Smtp-Origin-Hostprefix: devbig From: Richard Wareing Smtp-Origin-Hostname: devbig279.prn1.facebook.com To: CC: Smtp-Origin-Cluster: prn1c29 Subject: [PATCH v5] xfs: Add test for CVE-2017-14340 Date: Thu, 21 Sep 2017 19:34:46 -0700 Message-ID: <20170922023446.2616054-1-rwareing@fb.com> X-Mailer: git-send-email 2.9.5 X-FB-Internal: Safe MIME-Version: 1.0 X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-09-21_07:, , signatures=0 Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Verify kernel doesn't panic when user attempts to set realtime flags on non-realtime FS, using kernel compiled with CONFIG_XFS_RT. Unpatched kernels will panic during this test. Kernels not compiled with CONFIG_XFS_RT should pass test. This bug was fixed via commit b31ff3cdf540110da4572e3e29bd172087af65cc on the main kernel tree. Signed-off-by: Richard Wareing Reviewed-by: Darrick J. Wong --- Changes since v4: * Check inherit flag on scratch mount via lsattr + grep Changes since v3: * Tabs not spaces * Test added to auto group * _filter_xfs_io filter only * Removed _require_test Changes since v2: * Added to dangerous group Changes since v1: * Corrected copyright text tests/xfs/431 | 84 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ tests/xfs/431.out | 3 ++ tests/xfs/group | 1 + 3 files changed, 88 insertions(+) create mode 100755 tests/xfs/431 create mode 100644 tests/xfs/431.out diff --git a/tests/xfs/431 b/tests/xfs/431 new file mode 100755 index 0000000..414ec46 --- /dev/null +++ b/tests/xfs/431 @@ -0,0 +1,84 @@ +#! /bin/bash +# FS QA Test 431 +# +# Verify kernel doesn't panic when user attempts to set realtime flags +# on non-realtime FS, using kernel compiled with CONFIG_XFS_RT. Unpatched +# kernels will panic during this test. Kernels not compiled with +# CONFIG_XFS_RT should pass test. +# +# See CVE-2017-14340 for more information. +# +#----------------------------------------------------------------------- +# Copyright (c) 2017 Facebook, Inc. All Rights Reserved. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it would be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write the Free Software Foundation, +# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA +#----------------------------------------------------------------------- +# + +seq=`basename $0` +seqres=$RESULT_DIR/$seq +echo "QA output created by $seq" + +here=`pwd` +tmp=/tmp/$$ +status=1 # failure is the default! +trap "_cleanup; exit \$status" 0 1 2 3 15 + +_cleanup() +{ + cd / + rm -f $tmp.* +} + +# get standard environment, filters and checks +. ./common/rc +. ./common/filter + +# remove previous $seqres.full before test +rm -f $seqres.full + +# real QA test starts here + +# Modify as appropriate. +_supported_fs xfs +_supported_os Linux +_require_xfs_io_command "chattr" +_require_xfs_io_command "fsync" +_require_xfs_io_command "pwrite" +_require_scratch + +_scratch_mkfs >/dev/null 2>&1 +_scratch_mount + +# Set realtime inherit flag on scratch mount, suppress output +# as this may simply error out on future kernels, we will check +# exit code instead. +$XFS_IO_PROG -c 'chattr +t' $SCRATCH_MNT &> /dev/null + +# Erroring out here is fine, this would be desired behavior for +# FSes without realtime devices present. +if $XFS_IO_PROG -c 'lsattr' $SCRATCH_MNT | + grep '^[[:graph:]]\{7\}t[[:graph:]]\{8\}' &> /dev/null; then + # Attempt to write/fsync data to file + $XFS_IO_PROG -fc 'pwrite 0 1m' -c fsync $SCRATCH_MNT/testfile | + tee -a $seqres.full | _filter_xfs_io + + # Remove the rt inherit flag after we are done or xfs_repair + # will fail. + $XFS_IO_PROG -c 'chattr -t' $SCRATCH_MNT | tee -a $seqres.full 2>&1 +fi + +# success, all done +status=0 +exit diff --git a/tests/xfs/431.out b/tests/xfs/431.out new file mode 100644 index 0000000..8c14f11 --- /dev/null +++ b/tests/xfs/431.out @@ -0,0 +1,3 @@ +QA output created by 431 +wrote 1048576/1048576 bytes at offset 0 +XXX Bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) diff --git a/tests/xfs/group b/tests/xfs/group index 0a449b9..1765559 100644 --- a/tests/xfs/group +++ b/tests/xfs/group @@ -427,3 +427,4 @@ 428 dangerous_fuzzers dangerous_scrub dangerous_online_repair 429 dangerous_fuzzers dangerous_scrub dangerous_repair 430 dangerous_fuzzers dangerous_scrub dangerous_online_repair +431 auto quick dangerous