unusual ext2 FS corruption -- for statistics

Frank van Maarseveen (fvm@tasking.nl)
Fri, 23 Jul 1999 13:51:45 +0200

I think that 2.2.6-ac3 or one of the drivers was responsible for some
FS corruption. A shutdown couldn't unmount the file systems. On the next
boot Fsck detected this and filled /lost+found with strange looking files
(actually bogus block special devices). After getting rid of all of
this a disk fingerprinting tool discovered unusual modes on some files
(not seen as incorrect by e2fsprogs-1.10-6 or e2fsprogs-1.15-0):

(in /usr/share/locale/et_EE)

b---r-srwx 1 30309 12832 100, 32 Nov 21 2025 LC_NUMERIC

debugfs: show_inode_info LC_NUMERIC
Inode: 202153 Type: block special Mode: 0057 Flags: 0x20736168 Version: 1
User: 30309 Group: 12832 Size: 1633973039
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 540161073
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x74656c65 -- Tue Nov 18 22:32:21 2031
atime: 0x44203a32 -- Tue Mar 21 18:38:58 2006
mtime: 0x69206465 -- Fri Nov 21 14:08:53 2025
BLOCKS:
1769235488 539911533 1481197088 170804293
TOTAL: 4

After ordering all data (swapping hex bytes etc) following the inode
layout in /usr/include/linux/ext2_fs.h the following string was decoded:

/^@ev/sda2: Deleted i^@^@^@^@ 2^A^@142 has ^@^@^@^@ dtime. FIXED.

This was conformed by a hex dump of the disk area which contains the
inode (also /dev/sda2, add 811039k to offsets):
380: a4 81 00 00 5e 00 00 00 3b 2f 98 37 f2 f2 ff 35 ....^...;/.7...5
390: df d8 7a 35 00 00 00 00 00 00 01 00 02 00 00 00 ..z5............
3a0: 00 00 00 00 00 00 00 00 02 71 0c 00 00 00 00 00 .........q......
3b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
3c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
3d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
3e0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
3f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
400: 2f 64 65 76 2f 73 64 61 32 3a 20 44 65 6c 65 74 /dev/sda2: Delet
410: 65 64 20 69 00 00 00 00 20 32 01 00 31 34 32 20 ed i.... 2..142
420: 68 61 73 20 7a 65 72 6f 20 64 74 69 6d 65 2e 20 has zero dtime.
430: 20 46 49 58 45 44 2e 0a 00 00 00 00 00 00 00 00 FIXED..........
440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
460: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
480: a4 81 00 00 04 02 00 00 3b 2f 98 37 f2 f2 ff 35 ........;/.7...5
490: df d8 7a 35 00 00 00 00 00 00 01 00 02 00 00 00 ..z5............
4a0: 00 00 00 00 00 00 00 00 04 71 0c 00 00 00 00 00 .........q......
4b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
4c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
4e0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
4f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

So, the inode has been overwritten by a message of fsck itself (?!?)

Bootup messages:
Jul 2 11:10:51 turku syslogd 1.3-3: restart.
Jul 2 11:10:52 turku kernel: klogd 1.3-3, log source = /proc/kmsg started.
Jul 2 11:10:52 turku kernel: Inspecting /boot/System.map
Jul 2 11:10:54 turku kernel: Loaded 8309 symbols from /boot/System.map.
Jul 2 11:10:54 turku kernel: Symbols match kernel version 2.2.6.
Jul 2 11:10:54 turku kernel: No module symbols loaded.
Jul 2 11:10:54 turku kernel: Linux version 2.2.6-ac3 (root@sirkka) (gcc version 2.7.2.3) #1 Wed Apr 28 20:13:06 MEST 1999
Jul 2 11:10:54 turku kernel: Detected 74540190 Hz processor.
Jul 2 11:10:54 turku kernel: Console: mono *MDA 80x25
Jul 2 11:10:54 turku kernel: Calibrating delay loop... 29.70 BogoMIPS
Jul 2 11:10:54 turku kernel: Memory: 14164k/16384k available (1248k kernel code, 412k reserved, 520k data, 40k init)
Jul 2 11:10:54 turku kernel: CPU: Intel Pentium 75 - 200 stepping 05
Jul 2 11:10:54 turku kernel: Checking 386/387 coupling... OK, FPU using exception 16 error reporting.
Jul 2 11:10:54 turku kernel: Checking 'hlt' instruction... OK.
Jul 2 11:10:54 turku kernel: Intel Pentium with F0 0F bug - workaround enabled.
Jul 2 11:10:54 turku kernel: POSIX conformance testing by UNIFIX
Jul 2 11:10:54 turku kernel: PCI: PCI BIOS revision 2.10 entry at 0xfd8a1
Jul 2 11:10:54 turku kernel: PCI: Using configuration type 1
Jul 2 11:10:54 turku kernel: PCI: Probing PCI hardware
Jul 2 11:10:54 turku kernel: Linux NET4.0 for Linux 2.2
Jul 2 11:10:54 turku kernel: Based upon Swansea University Computer Society NET3.039
Jul 2 11:10:54 turku kernel: NET4: Unix domain sockets 1.0 for Linux NET4.0.
Jul 2 11:10:54 turku kernel: NET4: Linux TCP/IP 1.0 for NET4.0
Jul 2 11:10:54 turku kernel: IP Protocols: ICMP, UDP, TCP
Jul 2 11:10:54 turku kernel: NET4: Linux IPX 0.38 for NET4.0
Jul 2 11:10:54 turku kernel: IPX Portions Copyright (c) 1995 Caldera, Inc.
Jul 2 11:10:54 turku kernel: Initializing RT netlink socket
Jul 2 11:10:54 turku kernel: Starting kswapd v 1.5
Jul 2 11:10:54 turku kernel: Detected PS/2 Mouse Port.
Jul 2 11:10:54 turku kernel: Serial driver version 4.27 with no serial options enabled
Jul 2 11:10:54 turku kernel: ttyS00 at 0x03f8 (irq = 4) is a 16550A
Jul 2 11:10:54 turku kernel: keyboard: Too many NACKs -- noisy kbd cable?
Jul 2 11:10:54 turku kernel: keyboard: Too many NACKs -- noisy kbd cable?
no keyboard attached.
Jul 2 11:10:54 turku kernel: ttyS01 at 0x02f8 (irq = 3) is a 16550A
Jul 2 11:10:54 turku kernel: Non-volatile memory driver v1.0
Jul 2 11:10:54 turku kernel: RAM disk driver initialized: 16 RAM disks of 4096K size
Jul 2 11:10:54 turku kernel: loop: registered device at major 7
Jul 2 11:10:54 turku kernel: PIIX: IDE controller on PCI bus 00 dev 38
Jul 2 11:10:54 turku kernel: PIIX: not 100% native mode: will probe irqs later
Jul 2 11:10:54 turku kernel: PIIX: neither IDE port enabled (BIOS)
Jul 2 11:10:54 turku kernel: Floppy drive(s): fd0 is 1.44M
Jul 2 11:10:54 turku kernel: FDC 0 is a National Semiconductor PC87306
Jul 2 11:10:54 turku kernel: (scsi0) <Adaptec AHA-294X SCSI host adapter> found at PCI 15/0
Jul 2 11:10:54 turku kernel: (scsi0) Narrow Channel, SCSI ID=7, 16/255 SCBs
Jul 2 11:10:54 turku kernel: (scsi0) Downloading sequencer code... 412 instructions downloaded
Jul 2 11:10:54 turku kernel: scsi0 : Adaptec AHA274x/284x/294x (EISA/VLB/PCI-Fast SCSI) 5.1.13/3.2.4
Jul 2 11:10:54 turku kernel: <Adaptec AHA-294X SCSI host adapter>
Jul 2 11:10:54 turku kernel: scsi : 1 host.
Jul 2 11:10:54 turku kernel: Vendor: IBM Model: DPES-31080 Rev: S31K
Jul 2 11:10:54 turku kernel: Type: Direct-Access ANSI SCSI revision: 02
Jul 2 11:10:54 turku kernel: Detected scsi disk sda at scsi0, channel 0, id 0, lun 0
Jul 2 11:10:54 turku kernel: (scsi0:0:0:0) Synchronous at 10.0 Mbyte/sec, offset 15.
Jul 2 11:10:54 turku kernel: Vendor: HP Model: C3724S Rev: 5153
Jul 2 11:10:54 turku kernel: Type: Direct-Access ANSI SCSI revision: 02
Jul 2 11:10:54 turku kernel: Detected scsi disk sdb at scsi0, channel 0, id 1, lun 0
Jul 2 11:10:54 turku kernel: (scsi0:0:1:0) Synchronous at 10.0 Mbyte/sec, offset 15.
Jul 2 11:10:54 turku kernel: Vendor: IMS Model: CDD2000/00 Rev: 1.26
Jul 2 11:10:54 turku kernel: Type: CD-ROM ANSI SCSI revision: 02
Jul 2 11:10:54 turku kernel: Detected scsi CD-ROM sr0 at scsi0, channel 0, id 4, lun 0
Jul 2 11:10:54 turku kernel: Vendor: TANDBERG Model: TDC 3800 Rev: =04:
Jul 2 11:10:54 turku kernel: Type: Sequential-Access ANSI SCSI revision: 02
Jul 2 11:10:54 turku kernel: Detected scsi tape st0 at scsi0, channel 0, id 5, lun 0
Jul 2 11:10:54 turku kernel: scsi : detected 1 SCSI tape 1 SCSI cdrom 2 SCSI disks total.
Jul 2 11:10:54 turku kernel: sr0: scsi3-mmc drive: 0x/0x caddy
Jul 2 11:10:54 turku kernel: Uniform CDROM driver Revision: 2.55
Jul 2 11:10:54 turku kernel: SCSI device sda: hdwr sector= 512 bytes. Sectors= 2118144 [1034 MB] [1.0 GB]
Jul 2 11:10:54 turku kernel: SCSI device sdb: hdwr sector= 512 bytes. Sectors= 2354660 [1149 MB] [1.1 GB]
Jul 2 11:10:54 turku kernel: 3c59x.c:v0.99H 11/17/98 Donald Becker http://cesdis.gsfc.nasa.gov/linux/drivers/vortex.html
Jul 2 11:10:54 turku kernel: eth0: 3c509 at 0x300 tag 1, BNC port, address 00 20 af c8 ed 08, IRQ 10.
Jul 2 11:10:54 turku kernel: 3c509.c:1.16 (2.2) 2/3/98 becker@cesdis.gsfc.nasa.gov.
Jul 2 11:10:54 turku kernel: Partition check:
Jul 2 11:10:54 turku kernel: sda: sda1 sda2
Jul 2 11:10:54 turku kernel: sdb: sdb1
Jul 2 11:10:54 turku kernel: VFS: Mounted root (ext2 filesystem) readonly.
Jul 2 11:10:54 turku kernel: Freeing unused kernel memory: 40k freed
Jul 2 11:10:54 turku kernel: Adding Swap: 130748k swap-space (priority -1) 

-- 
Frank


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/