linux-ext4 - Re: e2fsck doesn't finish

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 18 Apr 2017 01:24:15 -0400
From:   Theodore Ts'o <tytso@....edu>
To:     sandeen@...hat.com
Cc:     Julius Schwartzenberg <julius.schwartzenberg@...il.com>,
        linux-ext4@...r.kernel.org
Subject: Re: e2fsck doesn't finish

On Mon, Apr 17, 2017 at 02:16:26PM -0500, Eric Sandeen wrote:
> 
> When I look at your image, it's finding tons of corruption - much
> more than just "step 1" followed by "e2fsck: aborted"

I also downloaded the image, and what I saw was a large number of
messages of the form:

HTREE directory inode 4195634 has an invalid root node.
Clear HTree index? yes

I'm prety sure this is a result of the e2image -S (scramble) option.

Followed by "e2fsck: aborted"

It looks like the problem is fixed with the latest version of
e2fsprogs, though.  I just tried running using a build of e2fsprogs
from the next branch, and this seems to allow e2fsck to fully fix the
file system and avoid the "aborted" message.  The interesting thing is
even after it is fixed, there is something which is causing the 1.43.4
version of e2fsprogs abort:

e2fsck 1.43.5-WIP (17-Feb-2017)
Pass 1: Checking inodes, blocks, and sizes
Timestamp(s) on inode 4200169 beyond 2310-04-04 are likely pre-1970.
Fix? yes

Timestamp(s) on inode 4201357 beyond 2310-04-04 are likely pre-1970.
Fix? yes

Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

home: ***** FILE SYSTEM WAS MODIFIED *****
home: 2185285/16179200 files (9.7% non-contiguous), 58130079/64713836 blocks
<tytso@...lcc> {/home/tytso}
1012% /sbin/e2fsck -fy /tmp/test.img
e2fsck 1.43.4 (31-Jan-2017)
Pass 1: Checking inodes, blocks, and sizes
e2fsck: aborted

The obvious first guess is that there was a bug in the date encoding
validity checking.

     	      	      	       	     	      - Ted

Download attachment "sda4.log.gz" of type "application/gzip" (9620 bytes)