linux-ext4 - Re: ext4 bug and/or e2fsck hole

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 07 Apr 2009 16:13:24 -0700
From:	Andreas Dilger <adilger@....com>
To:	Kevin Shanahan <kmshanah@...b.org.au>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: ext4 bug and/or e2fsck hole

On Apr 08, 2009  06:18 +0930, Kevin Shanahan wrote:
> I have a problem where my ext4 filesystem has been corrupted
> previously[1], but after being repaired by e2fsck problems still
> remain.
> 
> Previously, some corruption occured with the directory entries in this
> directory which e2fsck "fixed" and was happy that the fs was
> consistent, but things didn't quite get back to normal:
> 
> hermes:/srv/samba/local/apps/CIM8/Release-Notes# ls -l
> total 3120
> -rw-rw----+ 1 root          WUM3\it - dataadm   6320 2007-11-12 11:35 rb_200711_02.pdf
> sr-S-----x  1     167085146        3064914020      0 1988-03-09 06:02 rc_200705_01.pdf
> 
> Everything looks okay there except the one file with weird
> permissions, group and owner numbers. Look what happens when I try to
> delete the files from this directory:
> 
> hermes:/srv/samba/local/apps/CIM8/Release-Notes# rm *
> 
> The filesystem was read-write beforehand. Here's what showed up in syslog:
> 
> Apr  8 05:48:58 hermes kernel: attempt to access beyond end of device
> Apr  8 05:48:58 hermes kernel: dm-0: rw=0, want=824255763709960, limit=2147483648
> Apr  8 05:48:58 hermes kernel: EXT4-fs error (device dm-0): ext4_xattr_delete_inode: inode 383: block 103031970463744 read error
> Apr  8 05:48:58 hermes kernel: Aborting journal on device dm-0:8.
> Apr  8 05:48:58 hermes kernel: Remounting filesystem read-only
> Apr  8 05:48:58 hermes kernel: EXT4-fs error (device dm-0) in ext4_free_inode: Journal has aborted
> 
> So now I unmount and run fsck again:
> 
> hermes:~# e2fsck -p -f -v /dev/dm-0
> /dev/dm-0: recovering journal

What version of e2fsprogs is this?  It definitely appears that the
inode is corrupted (bad i_file_acl field), and e2fsck isn't fixing it.

Can you please dump this inode using "debugfs -c -R 'imap 383' /dev/dm-0"
and "dd if=/dev/dm-0 of=/tmp/bad_inode.383.bin bs=4k count=1 skip={blocknr}".

Cheers, Andreas
--
Andreas Dilger
Sr. Staff Engineer, Lustre Group
Sun Microsystems of Canada, Inc.

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html