erofs-freebsd-out-tree/tests/TC155-explicit-extent-pa-wrap.md

Test Case: 4-Byte Explicit Extent Physical Address Wrap

Test ID: TC155-explicit-extent-pa-wrap Category: Compression Mapping Priority: Critical Regression: Unchecked pa += plen can wrap and alias the next extent

Objective

Verify that every address/index increment used while walking 4-byte explicit extent records is checked and that a uint64_t physical-address wrap returns EINTEGRITY before the wrapped address can be used for I/O.

Fixture

Generate extent-pa-wrap.erofs with:

python3 tests/review_fixtures.py make \
  --output /work/build/repo22-review-fixes-fixtures

erofs-utils 1.8.6 cannot emit explicit extent records, so the helper performs a minimal structured conversion of a real extended legacy-compressed inode. It parses the root directory and target inode, then self-checks these fields:

• target /extent.bin remains an extended COMPRESSED_FULL inode;
• map header has Z_EROFS_ADVISE_EXTENTS and record size 4;
• the 64-bit initial physical base is 0xfffffffffffff000;
• the first two plen records are 8192 and 4096;
• initial_pa + first_plen > UINT64_MAX;
• the second logical cluster starts at offset 4096;
• the transformed image has a valid recomputed superblock CRC32C.

The second cluster is essential: an unchecked implementation wraps the first accumulation to 4096 and can present that low address as the second extent.

Procedure

1. Attach and mount the fixture read-only on FreeBSD 15.

2. Confirm stat /mnt/repo22-review/extent.bin succeeds, proving vnode creation and map-header parsing completed.

3. Read one byte from logical offset 4096 and capture the syscall with truss:

   truss -o extent-wrap.truss \
     dd if=/mnt/repo22-review/extent.bin of=/dev/null bs=1 skip=4096 count=1
   

4. Require nonzero dd status and a read/pread result of ERR#97 in the trace. Repeat the probe to exercise vnode-cache reuse.

5. Confirm there is no physical read at wrapped offset 4096, panic, trap, or assertion in dmesg; then unmount, detach, and unload the module.

Expected Results

• Both reads fail promptly with FreeBSD EINTEGRITY (97).
• No wrapped physical address reaches decompression or device I/O.
• The guest remains responsive and cleanup leaves no EROFS mount, md provider, or EROFS module.