linux-ext4 - Re: [PATCH] Correction to check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070331004417.GJ3198@thunk.org>
Date:	Fri, 30 Mar 2007 20:44:17 -0400
From:	Theodore Tso <tytso@....edu>
To:	Kalpak Shah <kalpak@...sterfs.com>
Cc:	Andreas Dilger <adilger@...sterfs.com>,
	linux-ext4 <linux-ext4@...r.kernel.org>,
	Lustre-discuss <Lustre-discuss@...sterfs.com>
Subject: Re: [PATCH] Correction to check_filetype()

On Wed, Feb 21, 2007 at 02:45:59PM +0530, Kalpak Shah wrote:
> 
> If the mode of a directory gets corrupted, check_filetype() makes
> wrong decisions for all its sub-directories. For example, using
> debugfs we can corrupt the mode of a directory to 0140755 (i.e. a
> socket). e2fsck will set the filetype of all its subdirectories as 6
> (filetype for socket). All the subdirectories would be moved to
> lost+found, and in second run of e2fsck their filetype would be set
> back to 2.

Um, I'm not seeing this.  Using stock e2fsprogs, given the following
test image, I'm not seeing the behavior you describe.  

It does require a second e2fsck to fix things, which is bad; we need
to make sure the i_size is fixed in pass 1.

						- Ted

e2fsck 1.40-WIP (14-Nov-2006)
Pass 1: Checking inodes, blocks, and sizes
Inode 12, i_blocks is 2, should be 0.  Fix? yes

Pass 2: Checking directory structure
Entry 'dir' in / (2) has an incorrect filetype (was 2, should be 6).
Fix? yes

Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Inode 2 ref count is 4, should be 3.  Fix? yes

Inode 12 ref count is 2, should be 1.  Fix? yes

Unattached inode 13
Connect to /lost+found? yes

Inode 13 ref count is 2, should be 1.  Fix? yes

Unattached inode 14
Connect to /lost+found? yes

Inode 14 ref count is 2, should be 1.  Fix? yes

Unattached inode 15
Connect to /lost+found? yes

Inode 15 ref count is 2, should be 1.  Fix? yes

Pass 5: Checking group summary information
Block bitmap differences:  -21
Fix? yes

Free blocks count wrong for group #0 (75, counted=76).
Fix? yes

Free blocks count wrong (75, counted=76).
Fix? yes

Directories count wrong for group #0 (3, counted=2).
Fix? yes

foo.img: ***** FILE SYSTEM WAS MODIFIED *****
foo.img: 15/16 files (0.0% non-contiguous), 24/100 blocks
<tytso@...dygram> {/usr/projects/e2fsprogs/e2fsprogs/build/e2fsck}  
730% e2fsck -fy foo.img
e2fsck 1.40-WIP (14-Nov-2006)
Pass 1: Checking inodes, blocks, and sizes
Special (device/socket/fifo) inode 12 has non-zero size.  Fix? yes

Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information

foo.img: ***** FILE SYSTEM WAS MODIFIED *****
foo.img: 15/16 files (0.0% non-contiguous), 24/100 blocks

Download attachment "foo.img.gz" of type "application/octet-stream" (621 bytes)