Re: [PATCH 0/2] udf: Fix corrupt on-disk integrity descriptor following sync()

[Steve Magnani <steve.magnani@digidescorp.com>]

On 2/8/19 11:34 AM, Steve Magnani wrote:
> In cases where the next unique ID or file/directory count of the
> in-core Logical Volume Integrity Descriptor have been updated,
> a sync() causes a (corrupt) LVID with a stale CRC to be written to disk.
>
> Ordinarily, this is corrected by an update of the on-disk LVID that occurs
> when the filesystem is unmounted. However, if power is lost or the
> filesystem resides on a device that is surprise-removed, the corrupt LVID
> remains and can complicate later remounting or fsck/chkdsk.

"Complicate later remounting" turns out to be an understatement.
Actually it seems that this one event can trigger more silent corruption
of the filesystem on future remounts.

The driver will mount without complaint a filesystem that lacks a valid LVID.
But in this scenario, every time lvid_get_unique_id() is called to generate
an ID for a new inode or link, it returns zero. It appears that callers
happily assign this zero to all new inodes or links, with no indication to
the user or in the syslog that a problem is brewing.

I lost the entire contents of a flash disk to what was probably an
instance of this kind of corruption, when I told Windows chkdsk to
repair it.

I'll try to solve that in a separate followon patchset.
The simplest solution I can think of is to force read-only mount when
no LVID is available.

Regards,
------------------------------------------------------------------------
  Steven J. Magnani               "I claim this network for MARS!
  www.digidescorp.com              Earthling, return my space modulator!"

  #include <standard.disclaimer>