4 # Test case for image corruption (overlapping data structures) in qcow2
6 # Copyright (C) 2013 Red Hat, Inc.
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 2 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
23 owner=hreitz@redhat.com
26 echo "QA output created by $seq"
28 status=1 # failure is the default!
34 trap "_cleanup; exit \$status" 0 1 2 3 15
36 # Sometimes the error line might be dumped before/after an event
37 # randomly. Mask it out for specific test that may trigger this
38 # uncertainty for current test for now.
41 sed '/Input\/output error/d'
44 # get standard environment, filters and checks
48 # This tests qcow2-specific low-level functionality
50 _supported_proto file fuse
52 # These tests only work for compat=1.1 images without an external
53 # data file with refcount_bits=16
54 _unsupported_imgopts 'compat=0.10' data_file \
55 'refcount_bits=\([^1]\|.\([^6]\|$\)\)'
57 # The repair process will create a large file - so check for availability first
58 _require_large_file 64G
60 rt_offset=65536 # 0x10000 (XXX: just an assumption)
61 rb_offset=131072 # 0x20000 (XXX: just an assumption)
62 l1_offset=196608 # 0x30000 (XXX: just an assumption)
63 l2_offset=262144 # 0x40000 (XXX: just an assumption)
64 l2_offset_after_snapshot=524288 # 0x80000 (XXX: just an assumption)
66 OPEN_RW="open -o overlap-check=all $TEST_IMG"
67 # Overlap checks are done before write operations only, therefore opening an
68 # image read-only makes the overlap-check option irrelevant
69 OPEN_RO="open -r $TEST_IMG"
72 echo "=== Testing L2 reference into L1 ==="
75 # Link first L1 entry (first L2 table) onto itself
76 # (Note the MSb in the L1 entry is set, ensuring the refcount is one - else any
77 # later write will result in a COW operation, effectively ruining this attempt
78 # on image corruption)
79 poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x03\x00\x00"
82 # The corrupt bit should not be set anyway
83 _qcow2_dump_header | grep incompatible_features
85 # Try to write something, thereby forcing the corrupt bit to be set
86 $QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
88 # The corrupt bit must now be set
89 _qcow2_dump_header | grep incompatible_features
91 # This information should be available through qemu-img info
92 _img_info --format-specific
94 # Try to open the image R/W (which should fail)
95 $QEMU_IO -c "$OPEN_RW" -c "read 0 512" 2>&1 | _filter_qemu_io \
99 # Try to open it RO (which should succeed)
100 $QEMU_IO -c "$OPEN_RO" -c "read 0 512" | _filter_qemu_io
102 # We could now try to fix the image, but this would probably fail (how should an
103 # L2 table linked onto the L1 table be fixed?)
106 echo "=== Testing cluster data reference into refcount block ==="
110 truncate -s "$(($l2_offset+65536))" "$TEST_IMG"
111 poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x00\x00"
112 # Mark cluster as used
113 poke_file "$TEST_IMG" "$(($rb_offset+8))" "\x00\x01"
114 # Redirect new data cluster onto refcount block
115 poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x02\x00\x00"
117 _qcow2_dump_header | grep incompatible_features
118 $QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
119 _qcow2_dump_header | grep incompatible_features
122 _check_test_img -r all
124 # The corrupt bit should be cleared
125 _qcow2_dump_header | grep incompatible_features
127 # Look if it's really really fixed
128 $QEMU_IO -c "$OPEN_RW" -c "write -P 0x2a 0 512" | _filter_qemu_io
129 _qcow2_dump_header | grep incompatible_features
132 echo "=== Testing cluster data reference into inactive L2 table ==="
135 $QEMU_IO -c "$OPEN_RW" -c "write -P 1 0 512" | _filter_qemu_io
136 $QEMU_IMG snapshot -c foo "$TEST_IMG"
137 $QEMU_IO -c "$OPEN_RW" -c "write -P 2 0 512" | _filter_qemu_io
138 # The inactive L2 table remains at its old offset
139 poke_file "$TEST_IMG" "$l2_offset_after_snapshot" \
140 "\x80\x00\x00\x00\x00\x04\x00\x00"
142 _qcow2_dump_header | grep incompatible_features
143 $QEMU_IO -c "$OPEN_RW" -c "write -P 3 0 512" | _filter_qemu_io
144 _qcow2_dump_header | grep incompatible_features
145 _check_test_img -r all
146 _qcow2_dump_header | grep incompatible_features
147 $QEMU_IO -c "$OPEN_RW" -c "write -P 4 0 512" | _filter_qemu_io
148 _qcow2_dump_header | grep incompatible_features
151 $QEMU_IO -c "$OPEN_RO" -c "read -P 4 0 512" | _filter_qemu_io
152 $QEMU_IMG snapshot -a foo "$TEST_IMG"
154 $QEMU_IO -c "$OPEN_RO" -c "read -P 1 0 512" | _filter_qemu_io
157 echo "=== Testing overlap while COW is in flight ==="
159 BACKING_IMG=$TEST_IMG.base
160 TEST_IMG=$BACKING_IMG _make_test_img 1G
162 $QEMU_IO -c 'write 0k 64k' "$BACKING_IMG" | _filter_qemu_io
164 _make_test_img -b "$BACKING_IMG" -F $IMGFMT 1G
165 # Write two clusters, the second one enforces creation of an L2 table after
166 # the first data cluster.
167 $QEMU_IO -c 'write 0k 64k' -c 'write 512M 64k' "$TEST_IMG" | _filter_qemu_io
168 # Free the first cluster. This cluster will soon enough be reallocated and
170 poke_file "$TEST_IMG" "$l2_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
171 poke_file "$TEST_IMG" "$(($rb_offset+10))" "\x00\x00"
172 # Now, corrupt the image by marking the second L2 table cluster as free.
173 poke_file "$TEST_IMG" "$(($rb_offset+12))" "\x00\x00"
174 # Start a write operation requiring COW on the image stopping it right before
175 # doing the read; then, trigger the corruption prevention by writing anything to
176 # any unallocated cluster, leading to an attempt to overwrite the second L2
177 # table. Finally, resume the COW write and see it fail (but not crash).
178 echo "open -o file.driver=blkdebug $TEST_IMG
183 resume 0" | $QEMU_IO | _filter_qemu_io
186 echo "=== Testing unallocated image header ==="
190 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
191 poke_file "$TEST_IMG" "$rb_offset" "\x00\x00"
192 $QEMU_IO -c "write 64k 64k" "$TEST_IMG" | _filter_qemu_io
195 echo "=== Testing unaligned L1 entry ==="
198 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
199 # This will be masked with ~(512 - 1) = ~0x1ff, so whether the lower 9 bits are
200 # aligned or not does not matter
201 poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x2a\x00"
202 $QEMU_IO -c "read 0 64k" "$TEST_IMG" | _filter_qemu_io
204 # Test how well zero cluster expansion can cope with this
206 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
207 poke_file "$TEST_IMG" "$l1_offset" "\x80\x00\x00\x00\x00\x04\x2a\x00"
208 $QEMU_IMG amend -o compat=0.10 "$TEST_IMG"
211 echo "=== Testing unaligned L2 entry ==="
214 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
215 poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
216 $QEMU_IO -c "read 0 64k" "$TEST_IMG" | _filter_qemu_io
219 echo "=== Testing unaligned pre-allocated zero cluster ==="
222 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
223 poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x01"
224 # zero cluster expansion
225 $QEMU_IMG amend -o compat=0.10 "$TEST_IMG"
228 echo "=== Testing unaligned reftable entry ==="
231 poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x02\x2a\x00"
232 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
235 echo "=== Testing non-fatal corruption on freeing ==="
238 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
239 poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
240 $QEMU_IO -c "discard 0 64k" "$TEST_IMG" | _filter_qemu_io
243 echo "=== Testing read-only corruption report ==="
246 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
247 poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
248 # Should only emit a single error message
249 $QEMU_IO -c "$OPEN_RO" -c "read 0 64k" -c "read 0 64k" | _filter_qemu_io
252 echo "=== Testing non-fatal and then fatal corruption report ==="
255 $QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
256 poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x05\x2a\x00"
257 poke_file "$TEST_IMG" "$(($l2_offset+8))" "\x80\x00\x00\x00\x00\x06\x2a\x00"
258 # Should emit two error messages
259 $QEMU_IO -c "discard 0 64k" -c "read 64k 64k" "$TEST_IMG" | _filter_qemu_io
262 echo "=== Testing empty refcount table ==="
265 poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
266 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
268 _check_test_img -r all
271 echo "=== Testing empty refcount table with valid L1 and L2 tables ==="
274 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
275 poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
276 # Since the first data cluster is already allocated this triggers an
277 # allocation with an explicit offset (using qcow2_alloc_clusters_at())
278 # causing a refcount block to be allocated at offset 0
279 $QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
281 _check_test_img -r all
284 echo "=== Testing empty refcount block ==="
287 poke_file "$TEST_IMG" "$rb_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
288 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
290 _check_test_img -r all
293 echo "=== Testing empty refcount block with compressed write ==="
296 $QEMU_IO -c "write 64k 64k" "$TEST_IMG" | _filter_qemu_io
297 poke_file "$TEST_IMG" "$rb_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
298 # The previous write already allocated an L2 table, so now this new
299 # write will try to allocate a compressed data cluster at offset 0.
300 $QEMU_IO -c "write -c 0k 64k" "$TEST_IMG" | _filter_qemu_io
302 _check_test_img -r all
305 echo "=== Testing zero refcount table size ==="
308 poke_file "$TEST_IMG" "56" "\x00\x00\x00\x00"
309 $QEMU_IO -c "write 0 64k" "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
311 _check_test_img -r all
314 echo "=== Testing incorrect refcount table offset ==="
317 poke_file "$TEST_IMG" "48" "\x00\x00\x00\x00\x00\x00\x00\x00"
318 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
321 echo "=== Testing dirty corrupt image ==="
326 # Let the refblock appear unaligned
327 poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\xff\xff\x2a\x00"
328 # Mark the image dirty, thus forcing an automatic check when opening it
329 $PYTHON qcow2.py "$TEST_IMG" set-feature-bit incompatible 0
330 # Open the image (qemu should refuse to do so)
331 $QEMU_IO -c close "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
333 echo '--- Repairing ---'
335 # The actual repair should have happened (because of the dirty bit),
336 # but some cleanup may have failed (like freeing the old reftable)
337 # because the image was already marked corrupt by that point
338 _check_test_img -r all
341 echo "=== Writing to an unaligned preallocated zero cluster ==="
346 # Allocate the L2 table
347 $QEMU_IO -c "write 0 64k" -c "discard 0 64k" "$TEST_IMG" | _filter_qemu_io
348 # Pretend there is a preallocated zero cluster somewhere inside the
350 poke_file "$TEST_IMG" "$l2_offset" "\x80\x00\x00\x00\x00\x00\x2a\x01"
352 $QEMU_IO -c "write 0 64k" "$TEST_IMG" | _filter_qemu_io
354 echo '--- Repairing ---'
355 _check_test_img -r all
358 echo '=== Discarding with an unaligned refblock ==='
363 $QEMU_IO -c "write 0 128k" "$TEST_IMG" | _filter_qemu_io
364 # Make our refblock unaligned
365 poke_file "$TEST_IMG" "$(($rt_offset))" "\x00\x00\x00\x00\x00\x00\x2a\x00"
366 # Now try to discard something that will be submitted as two requests
368 $QEMU_IO -c "discard 0 65537" "$TEST_IMG"
370 echo '--- Repairing ---'
371 # Fails the first repair because the corruption prevents the check
372 # function from double-checking
373 # (Using -q for the first invocation, because otherwise the
374 # double-check error message appears above the summary for some
375 # reason -- so let's just hide the summary)
376 _check_test_img -q -r all
377 _check_test_img -r all
380 echo "=== Discarding an out-of-bounds refblock ==="
385 # Pretend there's a refblock really up high
386 poke_file "$TEST_IMG" "$(($rt_offset+8))" "\x00\xff\xff\xff\x00\x00\x00\x00"
387 # Let's try to shrink the qcow2 image so that the block driver tries
388 # to discard that refblock (and see what happens!)
389 $QEMU_IMG resize --shrink "$TEST_IMG" 32M
391 echo '--- Checking and retrying ---'
392 # Image should not be resized
393 _img_info | grep 'virtual size'
394 # But it should pass this check, because the "partial" resize has
395 # already overwritten refblocks past the end
396 _check_test_img -r all
398 $QEMU_IMG resize --shrink "$TEST_IMG" 32M
399 _img_info | grep 'virtual size'
402 echo "=== Discarding a non-covered in-bounds refblock ==="
405 _make_test_img -o 'refcount_bits=1' 64M
407 # Pretend there's a refblock somewhere where there is no refblock to
408 # cover it (but the covering refblock has a valid index in the
410 # Every refblock covers 65536 * 8 * 65536 = 32 GB, so we have to point
411 # to 0x10_0000_0000 (64G) to point to the third refblock
412 poke_file "$TEST_IMG" "$(($rt_offset+8))" "\x00\x00\x00\x10\x00\x00\x00\x00"
413 $QEMU_IMG resize --shrink "$TEST_IMG" 32M
415 echo '--- Checking and retrying ---'
416 # Image should not be resized
417 _img_info | grep 'virtual size'
418 # But it should pass this check, because the "partial" resize has
419 # already overwritten refblocks past the end
420 _check_test_img -r all
422 $QEMU_IMG resize --shrink "$TEST_IMG" 32M
423 _img_info | grep 'virtual size'
426 echo "=== Discarding a refblock covered by an unaligned refblock ==="
429 _make_test_img -o 'refcount_bits=1' 64M
432 poke_file "$TEST_IMG" "$(($rt_offset+8))" "\x00\x00\x00\x10\x00\x00\x00\x00"
433 # But now we actually "create" an unaligned third refblock
434 poke_file "$TEST_IMG" "$(($rt_offset+16))" "\x00\x00\x00\x00\x00\x00\x02\x00"
435 $QEMU_IMG resize --shrink "$TEST_IMG" 32M
437 echo '--- Repairing ---'
438 # Fails the first repair because the corruption prevents the check
439 # function from double-checking
440 # (Using -q for the first invocation, because otherwise the
441 # double-check error message appears above the summary for some
442 # reason -- so let's just hide the summary)
443 _check_test_img -q -r all
444 _check_test_img -r all
447 echo "=== Testing the QEMU shutdown with a corrupted image ==="
450 poke_file "$TEST_IMG" "$rt_offset" "\x00\x00\x00\x00\x00\x00\x00\x00"
451 echo "{'execute': 'qmp_capabilities'}
452 {'execute': 'human-monitor-command',
453 'arguments': {'command-line': 'qemu-io drive \"write 0 512\"'}}
454 {'execute': 'quit'}" \
455 | $QEMU -qmp stdio -nographic -nodefaults \
456 -drive if=none,node-name=drive,file="$TEST_IMG",driver=qcow2 \
457 | _filter_qmp | _filter_qemu_io
460 echo "=== Testing incoming inactive corrupted image ==="
464 # Create an unaligned L1 entry, so qemu will signal a corruption when
465 # reading from the covered area
466 poke_file "$TEST_IMG" "$l1_offset" "\x00\x00\x00\x00\x2a\x2a\x2a\x2a"
468 # Inactive images are effectively read-only images, so this should be a
469 # non-fatal corruption (which does not modify the image)
470 echo "{'execute': 'qmp_capabilities'}
471 {'execute': 'human-monitor-command',
472 'arguments': {'command-line': 'qemu-io drive \"read 0 512\"'}}
473 {'execute': 'quit'}" \
474 | $QEMU -qmp stdio -nographic -nodefaults \
475 -blockdev "{'node-name': 'drive',
479 'filename': '$TEST_IMG'
481 -incoming exec:'cat /dev/null' \
483 | _filter_qmp | _filter_qemu_io | _filter_io_error
486 # Image should not have been marked corrupt
487 _img_info --format-specific | grep 'corrupt:'