erofs-freebsd-out-tree/tests/TC156-inode-timestamp-validation.md

Test Case: Compact and Extended Timestamp Validation

Test ID: TC156-inode-timestamp-validation Category: Inode Corruption Priority: Critical Regression: Timestamp arithmetic and conversion accepted malformed values

Objective

Verify checked compact-inode epoch addition, nanoseconds below one billion for both inode layouts, and rejection of unsigned seconds that cannot be represented by FreeBSD 15 amd64 time_t.

Fixtures

Generate the review fixtures with tests/review_fixtures.py. Its structured field assertions produce:

Image	Malformed field	Trigger
compact-epoch-wrap.erofs	epoch=UINT64_MAX, root i_mtime=1	uint64_t addition overflow
compact-epoch-range.erofs	epoch=INT64_MAX, target i_mtime=1	result exceeds signed 64-bit time_t
compact-nsec-invalid.erofs	fixed_nsec=1000000000	invalid compact nanoseconds
extended-nsec-invalid.erofs	target i_mtime_nsec=1000000000	invalid extended nanoseconds
extended-seconds-range.erofs	target i_mtime=INT64_MAX+1	seconds exceed time_t

Every image must pass the helper's EROFS field-location and CRC32C checks before guest transfer.

Procedure

1. For compact-epoch-wrap.erofs, attach the image and trace the mount. The mount must fail with ERR#97 when the root inode is decoded.
2. For compact-nsec-invalid.erofs, trace the mount. Superblock timestamp validation must fail with ERR#97 before a vnode is returned.
3. Mount compact-epoch-range.erofs. The root timestamp at INT64_MAX remains representable, but stat /zz-identity.txt must fail with ERR#97.
4. Mount each extended fixture. The root remains usable, while stat /extended-time.txt must fail with ERR#97 for the targeted field.
5. Repeat every failing access, compare dmesg, and clean the mount and md unit after each image.

Expected Results

• Compact epoch addition overflow returns EINTEGRITY, not a wrapped time.
• Exactly 999999999 remains the maximum accepted nanosecond value; 1000000000 is rejected for compact and extended timestamps.
• INT64_MAX seconds is accepted on the qualified amd64 ABI, while INT64_MAX+1 is rejected before assignment to timespec.tv_sec.
• No malformed inode creates a vnode with normalized, negative, or wrapped timestamps, and no panic or assertion occurs.