linux-kernel - Re: [PATCH 0/2] udf: Fix corrupt on-disk integrity descriptor following sync()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 11 Feb 2019 09:42:25 +0100
From:   Jan Kara <jack@...e.cz>
To:     Steve Magnani <steve.magnani@...idescorp.com>
Cc:     jack@...e.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/2] udf: Fix corrupt on-disk integrity descriptor
 following sync()

On Fri 08-02-19 22:06:59, Steve Magnani wrote:
> On 2/8/19 11:34 AM, Steve Magnani wrote:
> > In cases where the next unique ID or file/directory count of the
> > in-core Logical Volume Integrity Descriptor have been updated,
> > a sync() causes a (corrupt) LVID with a stale CRC to be written to disk.
> > 
> > Ordinarily, this is corrected by an update of the on-disk LVID that occurs
> > when the filesystem is unmounted. However, if power is lost or the
> > filesystem resides on a device that is surprise-removed, the corrupt LVID
> > remains and can complicate later remounting or fsck/chkdsk.

Thanks for the patches! I've added them to my tree. Just they seem to be
based on some relatively old kernel which required me to fixup some patch
conflicts. Please try to base your patches on current upstream kernel if
possible. Thanks!

> "Complicate later remounting" turns out to be an understatement.
> Actually it seems that this one event can trigger more silent corruption
> of the filesystem on future remounts.
> 
> The driver will mount without complaint a filesystem that lacks a valid LVID.
> But in this scenario, every time lvid_get_unique_id() is called to generate
> an ID for a new inode or link, it returns zero. It appears that callers
> happily assign this zero to all new inodes or links, with no indication to
> the user or in the syslog that a problem is brewing.
> 
> I lost the entire contents of a flash disk to what was probably an
> instance of this kind of corruption, when I told Windows chkdsk to
> repair it.

Ah, I'm sorry to hear that.

> I'll try to solve that in a separate followon patchset.
> The simplest solution I can think of is to force read-only mount when
> no LVID is available.

Agreed. OSTA UDF standard requires LVID to be present so forcing read-only
mount is perfectly fine.

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR