linux-ext4 - Re: Possible ext4 corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <20090311003845.GB3199@webber.adilger.int>
Date:	Tue, 10 Mar 2009 18:38:45 -0600
From:	Andreas Dilger <adilger@....com>
To:	Theodore Tso <tytso@....edu>
Cc:	Kevin Shanahan <kmshanah@...b.org.au>,
	Eric Sandeen <sandeen@...hat.com>, linux-ext4@...r.kernel.org
Subject: Re: Possible ext4 corruption - ACL related?

On Mar 10, 2009  18:48 -0400, Theodore Ts'o wrote:
> On Wed, Mar 11, 2009 at 07:44:51AM +1030, Kevin Shanahan wrote:
> > Thanks Ted. Just so I know what I'm doing if/when this comes up again, I
> > guess the process would be:
> > 
> >   - debugfs /dev/some-filesystem
> >   - debugfs:  stat "some/problem/file"
> >   - get the inode number from the output above (867 in this case)
> >   - debugfs dump 867 inode867.bin
> 
> Actually, it's a bit more complicated than that.  I should really add
> a hook to debugfs to automate this, but... to find the block to grab,
> you do this.   

[many complex steps deleted]

> So now we know that the block containing inode 867 is 65+54 = 119

Or you can use imap (which Ted probably wrote in the first place. :-)

debugfs: imap some/problem/file
Inode 867 is part of block group 0
	located at block 119, offset 0x0180

> Now to dump that block, we do:
> 
>     dd if=/dev/fs-device of=block-119.dump bs=4k skip=119 count=1

This part is the same.

> > Or perhaps running e2fsck -n first to see which inodes really look
> > corrupted and get the numbers that way. 
> 
> Yep.  In general, when you get corruption like this, the bad inodes
> comes in chunks of 16 (if you are using 256 byte inodes) or 32 (if you
> are using 128 byte inodes).

Cheers, Andreas
--
Andreas Dilger
Sr. Staff Engineer, Lustre Group
Sun Microsystems of Canada, Inc.

--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html