linux-ext4 - Re: More ext4 corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 5 Apr 2009 07:09:15 +0930
From:	Kevin Shanahan <kmshanah@...b.org.au>
To:	Theodore Tso <tytso@....edu>
Cc:	Eric Sandeen <sandeen@...hat.com>, linux-ext4@...r.kernel.org
Subject: Re: More ext4 corruption

On Sat, Apr 04, 2009 at 12:23:35PM -0400, Theodore Tso wrote:
> Hmm, what kernel version are you running at this point?  Going through
> your old e-mails I saw kernel log from 2.6.29-rc6; is that what you
> are still running?

Yeah, still 2.6.29-rc6. I was going to take an image of the block
device (logical volume), but it's going to take a bit too long and
probably not that useful anyway. I'll update to 2.6.29.1 today.

> The symptoms seem to be the same as before --- something is writing
> garbage into (apparently) a single 4k block, smashing part of your
> inode table.  It always seems to be a relatively low-numbered block.
> This time, affecting inode numbers in the range of 369-375.  
> 
> I don't remember if we've been through this procedure with you yet,
> but if you haven't run fsck yet, find out the block number containing
> the corrupted part of the inode table:
> 
> debugfs /dev/XXX
> debugfs: imap <375>
> Inode 375 is part of block group 0
>       located at block 88, offset 0x0600
> 
> And then do extract out the named block number like so:
> 
> dd if=/dev/XXX of=block88.dump bs=4k skip=88 count=1
> 
> then send us the 4k dump file, and let's see if we can see where it
> came from.  Maybe that will be a hint as to who or what wrote the
> garbage to that location on disk.

debugfs 1.41.3 (12-Oct-2008)
debugfs:  imap <375>
Inode 375 is part of block group 0
      located at block 312, offset 0x0600

Okay, same block as inode 372 which I sent to the list earlier.
 http://marc.info/?l=linux-ext4&m=123879692007843&w=2

Cheers,
Kevin.

Download attachment "block-312.dump" of type "application/octet-stream" (4096 bytes)