bin/41126: fsck_ffs does not check for Cylinder Magic and gets confused

[Bernhard Moellemann <zza%serpens.de@localhost>]

>Number:         41126
>Category:       bin
>Synopsis:       fsck_ffs does not check for Cylinder Magic and gets confused
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Apr 03 10:40:00 +0000 2009
>Originator:     Bernhard Moellemann
>Release:        NetBSD 5.0_RC1
>Organization:
Home entertainment construction site
>Environment:
System: NetBSD arcanic 5.0_RC1 NetBSD 5.0_RC1 (GENERIC) #0: Tue Feb 3 11:46:51 
CET 2009 root@arcanic:/mnt/top/src/src-5dm/obj/sys/arch/i386/compile/GENERIC 
i386
Architecture: i386
Machine: i386
>Description:

fsch_ffs reads values from a cylinder group header and uses them without
verifing if they may be broken. If a cylinder group header is seriously
broken, it is unable to fsck the filesystem

>How-To-Repeat:

Have a broken filesystem after a crash like this

cg 2152:
magic   7d7d7d80        tell    2c9d77a0000     time    Fri Aug 14 03:52:58 1908
cgx     -2105507712     niblk   -1903128946     ndblk   2038004089
nbfree  2071690105      ndir    2038004089      nifree  2071690107      nffree  
2038004089
rotor   2071690105      irotor  2105375611      frotor  2071690107
frsum   -2105245054     -2139061630     -2071690624
sum of frsum: 286461702 (dumpfs crashes at this line)

Note, that even cg_magic is bad!

fsck_ffs it and you get

too many inodes 18446744071806291598

>Fix:

not known. Perhaps a check in

src/sbin/fsck_ffs/pass1.c, line 107 like

if (!cg_chkmagic(cgp, 0))
     printf("CG %d: BAD MAGIC NUMBER\n", c);

and a skip and CG->new() operation would help?

    Bernhard  //
            \X/