xfs: Add test for CVE-2017-14340
PATCH v3 1/1 xfs: Add test for CVE-2017-14340
Verify kernel doesn't panic when user attempts to set realtime flags on non-realtime FS, using kernel compiled with CONFIG_XFS_RT. Unpatched kernels will panic during this test. Kernels not compiled with CONFIG_XFS_RT should pass test.
This bug was fixed via commit b31ff3cdf540110da4572e3e29bd172087af65cc on the main kernel tree.
---
Changes since v2:
* Added to dangerous group
Changes since v1:
* Corrected copyright text
tests/xfs/431 | 88 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ tests/xfs/431.out | 3 ++ tests/xfs/group | 1 + 3 files changed, 92 insertions(+) create mode 100755 tests/xfs/431 create mode 100644 tests/xfs/431.out
tests/xfs/431 new file +88 -0
@@ -0,0 +1,88 @@ +#! /bin/bash +# FS QA Test 431 +# +# Verify kernel doesn't panic when user attempts to set realtime flags +# on non-realtime FS, using kernel compiled with CONFIG_XFS_RT. Unpatched +# kernels will panic during this test. Kernels not compiled with +# CONFIG_XFS_RT should pass test. +# +# See CVE-2017-14340 for more information. +# +#----------------------------------------------------------------------- +# Copyright (c) 2017 Facebook, Inc. All Rights Reserved. +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it would be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write the Free Software Foundation, +# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA +#----------------------------------------------------------------------- +# + +seq=`basename $0` +seqres=$RESULT_DIR/$seq +echo "QA output created by $seq" + +here=`pwd` +tmp=/tmp/$$ +status=1 # failure is the default! +trap "_cleanup; exit \$status" 0 1 2 3 15 + +_cleanup() +{ + cd / + rm -f $tmp.* +} + +# get standard environment, filters and checks +. ./common/rc +. ./common/filter + +# remove previous $seqres.full before test +rm -f $seqres.full + +# real QA test starts here + +# Modify as appropriate. +_supported_fs xfs +_supported_os Linux +_require_xfs_io_command "chattr" +_require_xfs_io_command "fsync" +_require_xfs_io_command "pwrite" +_require_scratch +_require_test + +_scratch_mkfs >/dev/null 2>&1 +_scratch_mount + +# Set realtime inherit flag on scratch mount, suppress output +# as this may simply error out on future kernels, we will check +# exit code instead. +$XFS_IO_PROG -c 'chattr +t' $SCRATCH_MNT &> /dev/null +chattr_ret=$? + +# Erroring out here is fine, this would be desired behavior for +# FSes without realtime devices present. +if (( chattr_ret == 0)); then + # Attempt to write/fsync data to file + $XFS_IO_PROG -fc 'pwrite 0 1m' -c fsync $SCRATCH_MNT/testfile | + tee -a $seqres.full | common_line_filter | _filter_xfs_io + + # Remove the rt inherit flag after we are done or xfs_repair + # will fail. + $XFS_IO_PROG -c 'chattr -t' $SCRATCH_MNT | tee -a $seqres.full 2>&1 +fi + + +rm -f $SCRATCH_MNT/testfile + +# success, all done +status=0 +exit
tests/xfs/431.out new file +3 -0
@@ -0,0 +1,3 @@ +QA output created by 431 +wrote 1048576/1048576 bytes at offset 0 +XXX Bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
tests/xfs/group +1 -0
@@ -427,3 +427,4 @@ 428 dangerous_fuzzers dangerous_scrub dangerous_online_repair 429 dangerous_fuzzers dangerous_scrub dangerous_repair 430 dangerous_fuzzers dangerous_scrub dangerous_online_repair +431 quick dangerous
Signature · 1 line
2.9.5
tests/xfs/431 line 58
Quoted 3 lines
tests/xfs/431 new file +3
-0+_require_xfs_io_command "chattr" +_require_xfs_io_command "fsync" +_require_xfs_io_command "pwrite"
I think we expect these always to be there in general. But then again these checks won't hurt either.
Quoted 1 line
+_require_test
I can't see the test using the test device, so this should not be needed.
tests/xfs/431 line 73
Quoted 9 lines
tests/xfs/431 new file +9
-0+# Set realtime inherit flag on scratch mount, suppress output +# as this may simply error out on future kernels, we will check +# exit code instead. +$XFS_IO_PROG -c 'chattr +t' $SCRATCH_MNT &> /dev/null +chattr_ret=$? + +# Erroring out here is fine, this would be desired behavior for +# FSes without realtime devices present. +if (( chattr_ret == 0)); then
Don't want to be nitpicky, but the way we usuall write this would be:
$XFS_IO_PROG -c 'chattr +t' $SCRATCH_MNT &> /dev/null
if [ $? -eq 0 ]; then
Quoted 1 line
+rm -f $SCRATCH_MNT/testfile
We probably don't need to beother with this, as the scratch device gets reinitialized on every test that uses it.
Otherwise the test looks great, thanks a lot!