linux-ext4 - Re: ext4 bug and/or e2fsck hole

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090407233955.GA4328@kulgan>
Date:	Wed, 8 Apr 2009 09:09:55 +0930
From:	Kevin Shanahan <kmshanah@...b.org.au>
To:	Andreas Dilger <adilger@....com>
Cc:	linux-ext4@...r.kernel.org
Subject: Re: ext4 bug and/or e2fsck hole

On Tue, Apr 07, 2009 at 04:13:24PM -0700, Andreas Dilger wrote:
> On Apr 08, 2009  06:18 +0930, Kevin Shanahan wrote:
> > I have a problem where my ext4 filesystem has been corrupted
> > previously[1], but after being repaired by e2fsck problems still
> > remain.
> > 
> > Previously, some corruption occured with the directory entries in this
> > directory which e2fsck "fixed" and was happy that the fs was
> > consistent, but things didn't quite get back to normal:
> > 
> > hermes:/srv/samba/local/apps/CIM8/Release-Notes# ls -l
> > total 3120
> > -rw-rw----+ 1 root          WUM3\it - dataadm   6320 2007-11-12 11:35 rb_200711_02.pdf
> > sr-S-----x  1     167085146        3064914020      0 1988-03-09 06:02 rc_200705_01.pdf
> > 
> > Everything looks okay there except the one file with weird
> > permissions, group and owner numbers. Look what happens when I try to
> > delete the files from this directory:
> > 
> > hermes:/srv/samba/local/apps/CIM8/Release-Notes# rm *
> > 
> > The filesystem was read-write beforehand. Here's what showed up in syslog:
> > 
> > Apr  8 05:48:58 hermes kernel: attempt to access beyond end of device
> > Apr  8 05:48:58 hermes kernel: dm-0: rw=0, want=824255763709960, limit=2147483648
> > Apr  8 05:48:58 hermes kernel: EXT4-fs error (device dm-0): ext4_xattr_delete_inode: inode 383: block 103031970463744 read error
> > Apr  8 05:48:58 hermes kernel: Aborting journal on device dm-0:8.
> > Apr  8 05:48:58 hermes kernel: Remounting filesystem read-only
> > Apr  8 05:48:58 hermes kernel: EXT4-fs error (device dm-0) in ext4_free_inode: Journal has aborted
> > 
> > So now I unmount and run fsck again:
> > 
> > hermes:~# e2fsck -p -f -v /dev/dm-0
> > /dev/dm-0: recovering journal
> 
> What version of e2fsprogs is this?  It definitely appears that the
> inode is corrupted (bad i_file_acl field), and e2fsck isn't fixing it.

Using current Debian stable release:

hermes:~# e2fsck -V
e2fsck 1.41.3 (12-Oct-2008)
        Using EXT2FS Library version 1.41.3, 12-Oct-2008

> Can you please dump this inode using "debugfs -c -R 'imap 383' /dev/dm-0"
> and "dd if=/dev/dm-0 of=/tmp/bad_inode.383.bin bs=4k count=1 skip={blocknr}".

hermes:~# debugfs -c -R 'imap 383' /dev/dm-0
debugfs 1.41.3 (12-Oct-2008)
/dev/dm-0: catastrophic mode - not reading inode or group bitmaps
383: File not found by ext2_lookup 
hermes:~# debugfs -c -R 'imap <383>' /dev/dm-0
debugfs 1.41.3 (12-Oct-2008)
/dev/dm-0: catastrophic mode - not reading inode or group bitmaps
Inode 383 is part of block group 0
        located at block 312, offset 0x0e00

hermes:~# dd if=/dev/dm-0 of=bad_inode.383.bin bs=4k count=1 skip=312
1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 3.9273e-05 s, 104 MB/s

Cheers,
Kevin.

Download attachment "bad_inode.383.bin" of type "application/octet-stream" (4096 bytes)