2 # SPDX-License-Identifier: GPL-2.0
3 # Copyright (C) 2020 CTERA Networks. All Rights Reserved.
7 # Test two overlayfs file handle bugs:
8 # 1. Failure to query file handle size
9 # Fixed by kernel commit 144da23beab8:
10 # ovl: return required buffer size for file handles
12 # 2. Kernel OOPS on open by hand crafted malformed file handle
13 # Fixed by kernel commit 9aafc1b01873:
14 # ovl: potential crash in ovl_fid_to_fh()
17 _begin_fstest auto quick exportfs dangerous
19 # Import common functions.
22 # real QA test starts here
26 _require_test_program "open_by_handle"
27 # We need to require all features together, because nfs_export cannot
28 # be enabled when index is disabled
29 _require_scratch_overlay_features index nfs_export
32 _scratch_mount -o "index=on,nfs_export=on"
34 testdir=$SCRATCH_MNT/testdir
36 # Create directory with test file
37 $here/src/open_by_handle -cp $testdir
39 # Test query file handle size on dir and file
40 $here/src/open_by_handle -pz $testdir
42 # Export file handle into tmp file
43 $here/src/open_by_handle -o $tmp.file_handle $testdir
45 # Verify open by exported file handle
46 $here/src/open_by_handle -i $tmp.file_handle $testdir
48 # Mangle the exported file handle:
50 # handle_type = OVL_FILEID_V0 (0xfb)
51 # File handle is encoded in host order
52 # The command below crafts this header for little endian.
53 # On different big endian architectures the file handle will still
54 # be malformed just not with the specific values to trigger the bug
55 cp $tmp.file_handle $tmp.file_handle_v0
56 $XFS_IO_PROG -c "pwrite -S 0 0 8" -c "pwrite -S 1 0 1" -c "pwrite -S 0xfb 4 1" \
57 $tmp.file_handle_v0 >> $seqres.full
59 # Craft malformed v1 file handle:
61 # handle_type = OVL_FILEID_V1 (0xf8)
62 cp $tmp.file_handle $tmp.file_handle_v1
63 $XFS_IO_PROG -c "pwrite -S 0 0 8" -c "pwrite -S 1 0 1" -c "pwrite -S 0xf8 4 1" \
64 $tmp.file_handle_v1 >> $seqres.full
66 # Verify failure to open by mangled file handles
67 # This will trigger NULL pointer dereference on affected kernels
68 $here/src/open_by_handle -i $tmp.file_handle_v0 $testdir >> $seqres.full 2>&1 && \
69 _fail "open by mangaled file handle (v0) is expected to fail"
70 # This may trigger out of bound access warning on affected kernels
71 $here/src/open_by_handle -i $tmp.file_handle_v1 $testdir >> $seqres.full 2>&1 && \
72 _fail "open by mangaled file handle (v1) is expected to fail"
74 echo "Silence is golden"