linux-kernel - Re: 3.12-rc5 and overwritten partition table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131029201215.GD9568@quack.suse.cz>
Date:	Tue, 29 Oct 2013 21:12:15 +0100
From:	Jan Kara <jack@...e.cz>
To:	John Twideldum <twideldums_throwaway@....at>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: 3.12-rc5 and overwritten partition table

On Tue 29-10-13 12:37:01, John Twideldum wrote:
> Hi...
> 
> I have a shiny new Haswell notebook (Lenovo T440s), where with 3.11 processor power
> management didn't work, so I got 3.12-rc5 installed.
> Worked fine for a few days, then today it no longer boots and inspection yields...
> 
> # dd if=/dev/sda count=1 |od -t c |tr -d " "
> 512 bytes (512 B) copied, 0.00115806 s, 442 kB/s
> 0000000 13.00000\nalsa:hw
> 0000020 C0D0\t99.00000\nal
> 0000040 sa:hwC0D3\t99.000
> 0000060 00\nbacklight:acp
> 0000100 i_video0\t73.0000
> 0000120 0\nbacklight:acpi
> 0000140 _video0-power\t10
> 0000160 0.00000\nbackligh
> 0000200 t:intel_backligh
> 0000220 t\t0.00000\nbackli
> 0000240 ght:intel_backli
> 0000260 ght-power\t0.0000
> 0000300 0\ncpu-consumptio
> 0000320 n\t0.00000\ncpu-wa
> 0000340 keups\t875.00000\n
> 0000360 disk-operations\t
> 0000400 0.00000\ndisk-ope
> 0000420 rations-hard\t0.0
> 0000440 0000\neth0-link-1
> 0000460 00\t0.00000\neth0-
> 0000500 link-1000\t0.0000
> 0000520 0\neth0-link-high
> 0000540 \t0.00000\neth0-pa
> 0000560 ckets\t0.00000\net
> 0000600 h0-powerunsave\t0
> 0000620 .00000\neth0-up\t0
> 0000640 .00000\ngpu-opera
> 0000660 tions\t134.00000\n
> 0000700radio:hci0\t100.0
> 00007200000\nradio:phy0\t
> 0000740100.00000\nradio:
> 0000760tpacpi_bluetooth
> 0001000
> 
> :-(
> 
> In order to figure out the reason for this, can you kernel guys maybe
> a) tell me what is that datastructure?
> b) can power management be buggy to cause this - I played with powertop tuneables
>  approximately while this happened?
> 
> ...and point me to a recovery tool/doc for finding the partitions again,
> "testdisk" tool only found 1 of 3, the least important one at the beginning of
> disk but not the rest :-(
  You can always look for fs-specific magic numbers in the superblock. What
filesystems did you use?

								Honza
-- 
Jan Kara <jack@...e.cz>
SUSE Labs, CR
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/