linux-kernel - Re: [PATCH 0/2] udf: Fix corrupt on-disk integrity descriptor following sync()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 Feb 2019 22:06:59 -0600
From:   Steve Magnani <steve.magnani@...idescorp.com>
To:     jack@...e.com
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/2] udf: Fix corrupt on-disk integrity descriptor
 following sync()

On 2/8/19 11:34 AM, Steve Magnani wrote:
> In cases where the next unique ID or file/directory count of the
> in-core Logical Volume Integrity Descriptor have been updated,
> a sync() causes a (corrupt) LVID with a stale CRC to be written to disk.
>
> Ordinarily, this is corrected by an update of the on-disk LVID that occurs
> when the filesystem is unmounted. However, if power is lost or the
> filesystem resides on a device that is surprise-removed, the corrupt LVID
> remains and can complicate later remounting or fsck/chkdsk.

"Complicate later remounting" turns out to be an understatement.
Actually it seems that this one event can trigger more silent corruption
of the filesystem on future remounts.

The driver will mount without complaint a filesystem that lacks a valid LVID.
But in this scenario, every time lvid_get_unique_id() is called to generate
an ID for a new inode or link, it returns zero. It appears that callers
happily assign this zero to all new inodes or links, with no indication to
the user or in the syslog that a problem is brewing.

I lost the entire contents of a flash disk to what was probably an
instance of this kind of corruption, when I told Windows chkdsk to
repair it.

I'll try to solve that in a separate followon patchset.
The simplest solution I can think of is to force read-only mount when
no LVID is available.

Regards,
------------------------------------------------------------------------
  Steven J. Magnani               "I claim this network for MARS!
  www.digidescorp.com              Earthling, return my space modulator!"

  #include <standard.disclaimer>