From patchwork Sun Jun 14 07:01:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amir Goldstein X-Patchwork-Id: 11603191 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 4689114DD for ; Sun, 14 Jun 2020 07:01:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2E7F92074D for ; Sun, 14 Jun 2020 07:01:31 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="epCYZGec" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726591AbgFNHBa (ORCPT ); Sun, 14 Jun 2020 03:01:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726672AbgFNHBV (ORCPT ); Sun, 14 Jun 2020 03:01:21 -0400 Received: from mail-wm1-x343.google.com (mail-wm1-x343.google.com [IPv6:2a00:1450:4864:20::343]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 669E5C08C5C2; Sun, 14 Jun 2020 00:01:21 -0700 (PDT) Received: by mail-wm1-x343.google.com with SMTP id r9so11594966wmh.2; Sun, 14 Jun 2020 00:01:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=VgsbU1olGZ3FSR/kBLu1xMOGeLhjZCKyfVl010oEcDc=; b=epCYZGec87TIrpU+STFdLLD6SHZyr/4T1+Y7volVaXoK99pdgxDYuRM+u+/ExBH0Hl STZnkgiQBDe+GJzmBmz3tiRgK6zrqv1HUwxsUlcQwOvGqs6NSaT2995rMvcx4b67ECaZ welizIgzxcaR1DtuECh6/FBR2tUtMA/Mt9eaH8XDgzhGprSyqNsAv/XwgTtKmFdozmRf WUDYBDr070ukTelAqZs79tiO9g7zrHt5eNj2stklTm2GgLCHC7enapPO9bPsefMZDtGg PwKbFepvfiWULO86lTClwt5HpEJnYwCwPaDYYcXqtOVUFPyNF98952IXzCj56XptrsrH 86FQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=VgsbU1olGZ3FSR/kBLu1xMOGeLhjZCKyfVl010oEcDc=; b=pyooCUPGmSeLvKXyNPrZoOxc7G3dLq7UwjGo0ql6usxc6QF7jVIyCrNlllldUQlYp5 dbCJxdKuEZsxatyQLNzI/nsoJc3flGg299KSx1kiCsIaxZbipyqVtfRtKcAM4WofMPSW q3Bj5CQ9mPENG973ywD3JjZqG3Bs63ejyFz4JdaZws8yoNtatG9Pf33eurIf4jsORFUr IRwUqxMGxi3ZO8BaeXGgkk/c06fRuj/OJElRvLWTPxOXhjfTxKj1ddPMqP405thMkgAr W59qiV/hKxcZhSapEA+hsKafmLiN/yPKelC8rFttqKwd5hrhUrqRkPyBUNPox5IoEE3j DfcQ== X-Gm-Message-State: AOAM531Iy/KlH1pnYmRV3rAFkPUhqfN/z9e7GVeT1Zu3NYVCBTzZCwVH a6pd89gc4KQZVp1Yzx0+bfk= X-Google-Smtp-Source: ABdhPJzPWsfQ8WoUR86fLZONsQBF5W0e65BiUhHGMyb9ujj0Rd9OWICrh8rmP4BJ+HpJ30vXQ9eIBw== X-Received: by 2002:a05:600c:2215:: with SMTP id z21mr7204113wml.48.1592118080055; Sun, 14 Jun 2020 00:01:20 -0700 (PDT) Received: from localhost.localdomain ([5.102.204.95]) by smtp.gmail.com with ESMTPSA id i10sm17951010wrw.51.2020.06.14.00.01.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Jun 2020 00:01:19 -0700 (PDT) From: Amir Goldstein To: Eryu Guan Cc: Miklos Szeredi , Dan Carpenter , Lubos Dolezel , linux-unionfs@vger.kernel.org, fstests@vger.kernel.org Subject: [PATCH v2 1/2] open_by_handle: add option -z to query file handle size Date: Sun, 14 Jun 2020 10:01:08 +0300 Message-Id: <20200614070109.29842-2-amir73il@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200614070109.29842-1-amir73il@gmail.com> References: <20200614070109.29842-1-amir73il@gmail.com> Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org Instead of using MAX_HANDLE_SZ, query the filesystem buffer size and use that buffer size to get the file handle. Signed-off-by: Amir Goldstein --- src/open_by_handle.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/src/open_by_handle.c b/src/open_by_handle.c index 4fdfacd7..0f74ed08 100644 --- a/src/open_by_handle.c +++ b/src/open_by_handle.c @@ -114,6 +114,7 @@ void usage(void) fprintf(stderr, "open_by_handle -i [N] - read test files handles from file and try to open by handle\n"); fprintf(stderr, "open_by_handle -o [N] - get file handles of test files and write handles to file\n"); fprintf(stderr, "open_by_handle -s [N] - wait in sleep loop after opening files by handle to keep them open\n"); + fprintf(stderr, "open_by_handle -z [N] - query filesystem required buffer size\n"); exit(EXIT_FAILURE); } @@ -136,11 +137,12 @@ int main(int argc, char **argv) int create = 0, delete = 0, nlink = 1, move = 0; int rd = 0, wr = 0, wrafter = 0, parent = 0; int keepopen = 0, drop_caches = 1, sleep_loop = 0; + int bufsz = MAX_HANDLE_SZ; if (argc < 2) usage(); - while ((c = getopt(argc, argv, "cludmrwapknhi:o:s")) != -1) { + while ((c = getopt(argc, argv, "cludmrwapknhi:o:sz")) != -1) { switch (c) { case 'c': create = 1; @@ -199,6 +201,9 @@ int main(int argc, char **argv) case 's': sleep_loop = 1; break; + case 'z': + bufsz = 0; + break; default: fprintf(stderr, "illegal option '%s'\n", argv[optind]); case 'h': @@ -300,8 +305,16 @@ int main(int argc, char **argv) return EXIT_FAILURE; } } else { - handle[i].fh.handle_bytes = MAX_HANDLE_SZ; + handle[i].fh.handle_bytes = bufsz; ret = name_to_handle_at(AT_FDCWD, fname, &handle[i].fh, &mount_id, 0); + if (bufsz < handle[i].fh.handle_bytes) { + /* Query the filesystem required bufsz and the file handle */ + if (ret != -1 || errno != EOVERFLOW) { + fprintf(stderr, "Unexpected result from name_to_handle_at(%s)\n", fname); + return EXIT_FAILURE; + } + ret = name_to_handle_at(AT_FDCWD, fname, &handle[i].fh, &mount_id, 0); + } if (ret < 0) { strcat(fname, ": name_to_handle"); perror(fname); @@ -334,8 +347,16 @@ int main(int argc, char **argv) return EXIT_FAILURE; } } else { - dir_handle.fh.handle_bytes = MAX_HANDLE_SZ; + dir_handle.fh.handle_bytes = bufsz; ret = name_to_handle_at(AT_FDCWD, test_dir, &dir_handle.fh, &mount_id, 0); + if (bufsz < dir_handle.fh.handle_bytes) { + /* Query the filesystem required bufsz and the file handle */ + if (ret != -1 || errno != EOVERFLOW) { + fprintf(stderr, "Unexpected result from name_to_handle_at(%s)\n", dname); + return EXIT_FAILURE; + } + ret = name_to_handle_at(AT_FDCWD, test_dir, &dir_handle.fh, &mount_id, 0); + } if (ret < 0) { strcat(dname, ": name_to_handle"); perror(dname); From patchwork Sun Jun 14 07:01:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amir Goldstein X-Patchwork-Id: 11603193 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9C471618 for ; Sun, 14 Jun 2020 07:01:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 83A2B20776 for ; Sun, 14 Jun 2020 07:01:31 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="D/pB2cNR" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726648AbgFNHBb (ORCPT ); Sun, 14 Jun 2020 03:01:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726717AbgFNHBX (ORCPT ); Sun, 14 Jun 2020 03:01:23 -0400 Received: from mail-wm1-x343.google.com (mail-wm1-x343.google.com [IPv6:2a00:1450:4864:20::343]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D5DA1C08C5C3; Sun, 14 Jun 2020 00:01:22 -0700 (PDT) Received: by mail-wm1-x343.google.com with SMTP id u26so11796024wmn.1; Sun, 14 Jun 2020 00:01:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Zbzfo518C8JhEbFEZyO7j4q+r+5BxTBmU8yF4vlPh/I=; b=D/pB2cNROtVU4YReQc0MzkX6yA14B8U8WPevwnPGcHvTZ6cKprhMj/Ac///T4Vn7DG bV7LR2LXo/BrAad81LjR5cbKabcI6e9yV5usxmMuIQRtgOcIedKbG4spGh3SqZ8OMIti Nyk96N95dzYo3G6B8bzZKer03EMYy0axfdfSEt1lmZCZLSf4XTXjbam059r1n7XzirYm 5reMGslIfC0YekQruZw95QlK+IOt0yUCsHJyPUDZTJywRE3STFKZ5TJPLh2BkFZ0MgMe 0WoJKG4YwZ77dTJJUZJ0ojbY7hhYulIeIZcd4jMlmU+S98wdX2PiCvFY82unThjL66xd 0IgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Zbzfo518C8JhEbFEZyO7j4q+r+5BxTBmU8yF4vlPh/I=; b=Y75K1tQU3n/lTUJgl3alvtfKP+8l27tD7JGBmp/bLvu5BnsN1nIFw2XxdsLWmPy21X CKKvd+msuBAy0oLEeuqcLLlhs//eE2n4FrzHb6W45ULz0LCWWXL6B/vKIecpMGsAfdKv LyAsc7d8RFnFFNIEySZdGJs8TDJcd+Qb4N8hOkcvLhujm6X4b4KpnqnmDFLeo1mMVNVj thvBv+lyGgnR+C9Jxs9D2jAHG5v/LRavMqaqKeZqWyCm0eCfrJ7fakQQKxBlL3GZkpYn zS7M1V/4Nn9yFMi5AmGKqpc8h/KLYh468/UGckoKk5ekSMCJD9cgmUQPalWuNXHitUaH bYtQ== X-Gm-Message-State: AOAM532OYrm/o+ziR85igkQ53lj3xhC9f0wgdy8riqSL9k3nU1OHpI/T I42sRLlrs2NFtKXUNsuHX5o= X-Google-Smtp-Source: ABdhPJzEyY6wPgT9Vr9s9dvQbNN8+sqVBhoyHd1UskCXjpmO2DQZRpj7xOMgi5TJjktjYaUn5sqUYw== X-Received: by 2002:a7b:cf13:: with SMTP id l19mr6804844wmg.76.1592118081594; Sun, 14 Jun 2020 00:01:21 -0700 (PDT) Received: from localhost.localdomain ([5.102.204.95]) by smtp.gmail.com with ESMTPSA id i10sm17951010wrw.51.2020.06.14.00.01.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Jun 2020 00:01:21 -0700 (PDT) From: Amir Goldstein To: Eryu Guan Cc: Miklos Szeredi , Dan Carpenter , Lubos Dolezel , linux-unionfs@vger.kernel.org, fstests@vger.kernel.org Subject: [PATCH v2 2/2] overlay: regression test for two file handle bugs Date: Sun, 14 Jun 2020 10:01:09 +0300 Message-Id: <20200614070109.29842-3-amir73il@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20200614070109.29842-1-amir73il@gmail.com> References: <20200614070109.29842-1-amir73il@gmail.com> Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org Test two overlayfs file handle bugs: 1. Failure to query file handle size Fixed by kernel commit 144da23beab8: ovl: return required buffer size for file handles 2. Kernel OOPS on open by hand crafted malformed file handle Fixed by kernel commit 9aafc1b01873: ovl: potential crash in ovl_fid_to_fh() Signed-off-by: Amir Goldstein --- Changes since v1: - Document final kernel commit id - Add test for mangled V1 file handle tests/overlay/074 | 92 +++++++++++++++++++++++++++++++++++++++++++ tests/overlay/074.out | 2 + tests/overlay/group | 1 + 3 files changed, 95 insertions(+) create mode 100755 tests/overlay/074 create mode 100644 tests/overlay/074.out diff --git a/tests/overlay/074 b/tests/overlay/074 new file mode 100755 index 00000000..29e3bebf --- /dev/null +++ b/tests/overlay/074 @@ -0,0 +1,92 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) 2020 CTERA Networks. All Rights Reserved. +# +# FS QA Test No. 074 +# +# Test two overlayfs file handle bugs: +# 1. Failure to query file handle size +# Fixed by kernel commit 144da23beab8: +# ovl: return required buffer size for file handles +# +# 2. Kernel OOPS on open by hand crafted malformed file handle +# Fixed by kernel commit 9aafc1b01873: +# ovl: potential crash in ovl_fid_to_fh() +# +seq=`basename $0` +seqres=$RESULT_DIR/$seq +echo "QA output created by $seq" + +here=`pwd` +tmp=/tmp/$$ +status=1 # failure is the default! +trap "_cleanup; exit \$status" 0 1 2 3 15 + +_cleanup() +{ + cd / + rm -f $tmp.* +} + +# get standard environment, filters and checks +. ./common/rc +. ./common/filter + +# real QA test starts here + +_supported_fs overlay +_supported_os Linux +_require_scratch +_require_test_program "open_by_handle" +# We need to require all features together, because nfs_export cannot +# be enabled when index is disabled +_require_scratch_overlay_features index nfs_export + +rm -f $seqres.full + +_scratch_mkfs +_scratch_mount -o "index=on,nfs_export=on" + +testdir=$SCRATCH_MNT/testdir + +# Create directory with test file +$here/src/open_by_handle -cp $testdir + +# Test query file handle size on dir and file +$here/src/open_by_handle -pz $testdir + +# Export file handle into tmp file +$here/src/open_by_handle -o $tmp.file_handle $testdir + +# Verify open by exported file handle +$here/src/open_by_handle -i $tmp.file_handle $testdir + +# Mangle the exported file handle: +# handle_bytes = 1 +# handle_type = OVL_FILEID_V0 (0xfb) +# File handle is encoded in host order +# The command below crafts this header for little endian. +# On different big endian architectures the file handle will still +# be malformed just not with the specific values to trigger the bug +cp $tmp.file_handle $tmp.file_handle_v0 +$XFS_IO_PROG -c "pwrite -S 0 0 8" -c "pwrite -S 1 0 1" -c "pwrite -S 0xfb 4 1" \ + $tmp.file_handle_v0 >> $seqres.full + +# Craft malformed v1 file handle: +# handle_bytes = 1 +# handle_type = OVL_FILEID_V1 (0xf8) +cp $tmp.file_handle $tmp.file_handle_v1 +$XFS_IO_PROG -c "pwrite -S 0 0 8" -c "pwrite -S 1 0 1" -c "pwrite -S 0xf8 4 1" \ + $tmp.file_handle_v1 >> $seqres.full + +# Verify failure to open by mangled file handles +# This will trigger NULL pointer dereference on affected kernels +$here/src/open_by_handle -i $tmp.file_handle_v0 $testdir >> $seqres.full 2>&1 && \ + _fail "open by mangaled file handle (v0) is expected to fail" +# This may trigger out of bound access warning on affected kernels +$here/src/open_by_handle -i $tmp.file_handle_v1 $testdir >> $seqres.full 2>&1 && \ + _fail "open by mangaled file handle (v1) is expected to fail" + +echo "Silence is golden" +status=0 +exit diff --git a/tests/overlay/074.out b/tests/overlay/074.out new file mode 100644 index 00000000..380f0657 --- /dev/null +++ b/tests/overlay/074.out @@ -0,0 +1,2 @@ +QA output created by 074 +Silence is golden diff --git a/tests/overlay/group b/tests/overlay/group index 4841e47b..0cebcad0 100644 --- a/tests/overlay/group +++ b/tests/overlay/group @@ -76,3 +76,4 @@ 071 auto quick copyup redirect nested nonsamefs 072 auto quick copyup hardlink 073 auto quick whiteout +074 auto quick exportfs dangerous