Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH 0/2] udf: Fix corrupt on-disk integrity descriptor
 following sync()
From:   Steve Magnani <steve.magnani@digidescorp.com>
To:     jack@suse.com
Cc:     linux-kernel@vger.kernel.org
References: <20190208173455.20151-1-steve@digidescorp.com>
Message-ID: <7ce9c657-efba-5dbb-441d-acb00a13044b@digidescorp.com>
Date:   Fri, 8 Feb 2019 22:06:59 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.4.0
MIME-Version: 1.0
In-Reply-To: <20190208173455.20151-1-steve@digidescorp.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 2/8/19 11:34 AM, Steve Magnani wrote:
> In cases where the next unique ID or file/directory count of the
> in-core Logical Volume Integrity Descriptor have been updated,
> a sync() causes a (corrupt) LVID with a stale CRC to be written to disk.
>
> Ordinarily, this is corrected by an update of the on-disk LVID that occurs
> when the filesystem is unmounted. However, if power is lost or the
> filesystem resides on a device that is surprise-removed, the corrupt LVID
> remains and can complicate later remounting or fsck/chkdsk.

"Complicate later remounting" turns out to be an understatement.
Actually it seems that this one event can trigger more silent corruption
of the filesystem on future remounts.

The driver will mount without complaint a filesystem that lacks a valid LVID.
But in this scenario, every time lvid_get_unique_id() is called to generate
an ID for a new inode or link, it returns zero. It appears that callers
happily assign this zero to all new inodes or links, with no indication to
the user or in the syslog that a problem is brewing.

I lost the entire contents of a flash disk to what was probably an
instance of this kind of corruption, when I told Windows chkdsk to
repair it.

I'll try to solve that in a separate followon patchset.
The simplest solution I can think of is to force read-only mount when
no LVID is available.

Regards,
------------------------------------------------------------------------
  Steven J. Magnani               "I claim this network for MARS!
  www.digidescorp.com              Earthling, return my space modulator!"

  #include <standard.disclaimer>