aboutsummaryrefslogtreecommitdiff
path: root/sbin/fsck_ffs/fsck_ffs.8
Commit message (Collapse)AuthorAgeFilesLines
* Correct the location of the first backup superblock in fsck_ffs.8.Kirk McKusick2019-08-071-1/+1
| | | | | | | | | | | Make a note in the newfs.8 manual page to update the first backup superblock location when changing the default fragment size for the filesystem. Reported by: O. Hartmann Notes: svn path=/head/; revision=350682
* This update eliminates a kernel stack disclosure bug in UFS/FFSKirk McKusick2019-05-031-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | directory entries that is caused by uninitialized directory entry padding written to the disk. It can be viewed by any user with read access to that directory. Up to 3 bytes of kernel stack are disclosed per file entry, depending on the the amount of padding the kernel needs to pad out the entry to a 32 bit boundry. The offset in the kernel stack that is disclosed is a function of the filename size. Furthermore, if the user can create files in a directory, this 3 byte window can be expanded 3 bytes at a time to a 254 byte window with 75% of the data in that window exposed. The additional exposure is done by removing the entry, creating a new entry with a 4-byte longer name, extracting 3 more bytes by reading the directory, and repeating until a 252 byte name is created. This exploit works in part because the area of the kernel stack that is being disclosed is in an area that typically doesn't change that often (perhaps a few times a second on a lightly loaded system), and these file creates and unlinks themselves don't overwrite the area of kernel stack being disclosed. It appears that this bug originated with the creation of the Fast File System in 4.1b-BSD (Circa 1982, more than 36 years ago!), and is likely present in every Unix or Unix-like system that uses UFS/FFS. Amazingly, nobody noticed until now. This update also adds the -z flag to fsck_ffs to have it scrub the leaked information in the name padding of existing directories. It only needs to be run once on each UFS/FFS filesystem after a patched kernel is installed and running. Submitted by: David G. Lawrence <dg@dglawrence.com> Reviewed by: kib MFC after: 1 week Notes: svn path=/head/; revision=347066
* Exit fsck_ffs with non-zero status when file system is not repaired.David Bright2018-01-151-4/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the fsck_ffs program cannot fully repair a file system, it will output the message PLEASE RERUN FSCK. However, it does not exit with a non-zero status in this case (contradicting the man page claim that it "exits with 0 on success, and >0 if an error occurs." The fsck rc-script (when running "fsck -y") tests the status from fsck (which passes along the exit status from fsck_ffs) and issues a "stop_boot" if the status fails. However, this is not effective since fsck_ffs can return zero even on (some) errors. Effectively, it is left to a later step in the boot process when the file systems are mounted to detect the still-unclean file system and stop the boot. This change modifies fsck_ffs so that when it cannot fully repair the file system and issues the PLEASE RERUN FSCK message it also exits with a non-zero status. While here, the fsck_ffs man page has also been updated to document the failing exit status codes used by fsck_ffs. Previously, only exit status 7 was documented. Some of these exit statuses are tested for in the fsck rc-script, so they are clearly depended upon and deserve documentation. Reviewed by: mckusick, vangyzen, jilles (manpages) MFC after: 1 week Sponsored by: Dell EMC Differential Revision: https://reviews.freebsd.org/D13862 Notes: svn path=/head/; revision=328013
* Renumber copyright clause 4Warner Losh2017-02-281-1/+1
| | | | | | | | | | | | Renumber cluase 4 to 3, per what everybody else did when BSD granted them permission to remove clause 3. My insistance on keeping the same numbering for legal reasons is too pedantic, so give up on that point. Submitted by: Jan Schaumann <jschauma@stevens.edu> Pull Request: https://github.com/freebsd/freebsd/pull/96 Notes: svn path=/head/; revision=314436
* * Add missing parameters to usage()Renato Botelho2017-02-141-41/+43
| | | | | | | | | | | | | | | * Add missing parameters to manpage synopsis * Add missing description of -d flag * Sort flags descriptions Reviewed by: allanjude, kib Approved by: allanjude MFC after: 1 week Sponsored by: Rubicon Communications (Netgate) Differential Revision: https://reviews.freebsd.org/D9152 Notes: svn path=/head/; revision=313745
* Add history section to fsck_ffs(8)Sevan Janiyan2016-10-051-4/+15
| | | | | | | | | | | | Move sentence to a new line as advised by igor. PR: 212474 Approved by: bcr (mentor) MFC after: 5 days Differential Revision: https://reviews.freebsd.org/D8104 Notes: svn path=/head/; revision=306734
* Add the -R option to allow fsck_ffs to restart itself when too many criticalScott Long2013-12-301-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | errors have been detected in a particular run. Clean up the global state variables so that a restart can happen correctly. Separate the global variables in fsck_ffs and fsdb to their own file. This fixes header sharing with fscd. Correctly initialize, static-ize, and remove global variables as needed in dir.c. This fixes a problem with lost+found directories that was causing a segfault. Correctly initialize, static-ize, and remove global variables as needed in suj.c. Initialize the suj globals before allocating the disk object, not after. Also ensure that 'preen' mode doesn't conflict with 'restart' mode Submitted by: scottl, max Reviewed by: max, mckusick (earlier version) Obtained from: Netflix MFC after: 3 days Notes: svn path=/head/; revision=260068
* Document the -S flag to fsck_ffsScott Long2013-07-311-1/+6
| | | | | | | Obtained from: Netflix Notes: svn path=/head/; revision=253828
* Add a -Z option which zeroes unused blocks. It can be combined with -E,Dag-Erling Smørgrav2013-04-291-1/+10
| | | | | | | | | | in which case unused blocks are first zeroed and then erased. Reviewed by: mckusick MFC after: 3 weeks Notes: svn path=/head/; revision=250056
* Be more helpful about alternate superblocks.Edward Tomasz Napierala2012-02-101-1/+6
| | | | Notes: svn path=/head/; revision=231377
* Add an -E option to mirror newfs's. The idea is that if you have a systemDag-Erling Smørgrav2011-04-291-2/+20
| | | | | | | | | | | | | | | | | | | | | | that was built before ffs grew support for TRIM, your filesystem will have plenty of free blocks that the flash chip doesn't know are free, so it can't take advantage of them for wear leveling. Once you've upgraded your kernel, you enable TRIM on the filesystem (tunefs -t enable), then run fsck_ffs -E on it before mounting it. I tested this patch by half-filling an mdconfig'ed filesystem image, running fsck_ffs -E on it, then verifying that the contents were not damaged by comparing them to a pristine copy using rsync's checksum functionality. There is no reliable way to test it on real hardware. Many thanks to mckusick@, who provided the tricky parts of this patch and reviewed the final version. Reviewed by: mckusick@ MFC after: 3 weeks Notes: svn path=/head/; revision=221233
* Fix boo-boo in previous commit.Dag-Erling Smørgrav2011-04-271-7/+7
| | | | | | | MFC after: 3 weeks Notes: svn path=/head/; revision=221108
* Alphabetize the options. No date bump since no actual change to the text.Dag-Erling Smørgrav2011-04-271-4/+4
| | | | | | | MFC after: 3 weeks Notes: svn path=/head/; revision=221107
* Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki whileJoel Dahl2010-08-161-1/+1
| | | | | | | | | translating these manual pages. Minor corrections by me. Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp> Notes: svn path=/head/; revision=211397
* Fix typos and spelling mistakes.Joel Dahl2010-08-061-1/+1
| | | | Notes: svn path=/head/; revision=210933
* Note that foreground fsck should be run after a filesystem related panic.Kirk McKusick2010-07-231-0/+9
| | | | | | | | Suggested by: Mikhail Teterin (mi@) MFC after: 1 week Notes: svn path=/head/; revision=210415
* Update the actions previously attempted by the -D option to make themKirk McKusick2009-02-041-17/+10
| | | | | | | | | | | | | | | | | | | | | robust. With these changes fsck is now able to detect and reliably rebuild corrupted cylinder group maps. The -D option is no longer necessary as it has been replaced by a prompt asking whether the corrupted cylinder group should be rebuilt and doing so when requested. These actions are only offered and taken when running fsck in manual mode. Corrupted cylinder groups found during preen mode cause the fsck to fail. Add the -r option to free up excess unused inodes. Decreasing the number of preallocated inodes reduces the running time of future runs of fsck and frees up space that can allocated to files. The -r option is ignored when running in preen mode. Reviewed by: Xin LI <delphij@> Sponsored by: Rsync.net Notes: svn path=/head/; revision=188110
* Add the '-C' "check clean" flag. If the FS is marked clean, skip fileDavid E. O'Brien2009-01-301-4/+12
| | | | | | | | | | | system checking. However, if the file system is not clean, perform a full fsck. Reviewed by: delphij Obtained from: Juniper Networks Notes: svn path=/head/; revision=187931
* Rename option 'C' to 'D' (damaged) in order to avoid a conflict with upcomingXin LI2009-01-201-22/+22
| | | | | | | | | | Juniper 'C' (clean) flag. Requested by: obrien MFC after: 1 week Notes: svn path=/head/; revision=187501
* Fix typo.Xin LI2009-01-121-1/+1
| | | | | | | | Submitted by: Ben Kaduk <minimarmot gmail com> MFC after: 3 days Notes: svn path=/head/; revision=187079
* Document the -F 's return statement.Remko Lodder2008-09-171-0/+6
| | | | | | | | | | | | | If the application returns succesfully the return code is 7 (which means the filesystem is clean). PR: 127432 Submitted by: edwin MFC after: 3 days Notes: svn path=/head/; revision=183110
* Add a new flag, '-C' which enables a special mode that is intended forXin LI2008-04-101-2/+22
| | | | | | | | | | | | | catastrophic recovery. Currently, this mode only validates whether a cylindergroup has good signature data, and prompts the user to decide whether to clear it as a whole. This mode is useful when there is data damage on a disk and you are working on copy of the original disk, as fsck_ffs(8) tends to abnormally exit in such case, as a last resort to recover data from the disk. Notes: svn path=/head/; revision=178088
* Mention the default location of alternative super block on aXin LI2005-09-201-2/+2
| | | | | | | | | | | UFS2 file system, in fsck_ffs(8). Submitted by: KOMATSU Shinichiro <koma2 at lovepeers ! org> PR: docs/86362 MFC After: 3 days Notes: svn path=/head/; revision=150365
* Sync program's usage() with manpage's SYNOPSIS.Ruslan Ermilov2005-02-101-1/+1
| | | | Notes: svn path=/head/; revision=141611
* Added the EXIT STATUS section where appropriate.Ruslan Ermilov2005-01-171-2/+2
| | | | Notes: svn path=/head/; revision=140368
* Mechanically kill hard sentence breaks.Ruslan Ermilov2004-07-021-2/+4
| | | | Notes: svn path=/head/; revision=131488
* Remove advertising clause from University of California Regent's license,Mark Murray2004-04-091-4/+0
| | | | | | | | | per letter dated July 22, 1999. Approved by: core, imp Notes: svn path=/head/; revision=128073
* Uniformly refer to a file system as "file system".Ruslan Ermilov2002-12-121-1/+1
| | | | | | | Approved by: re Notes: svn path=/head/; revision=107788
* Fix some 'SYNOPSIS' and 'usage' messages.Tom Rhodes2002-08-271-1/+1
| | | | Notes: svn path=/head/; revision=102464
* s/filesystem/file system/g as discussed on -developersTom Rhodes2002-08-211-35/+35
| | | | Notes: svn path=/head/; revision=102231
* mdoc(7) police: section 1 and 8 manpages document their exitRuslan Ermilov2001-12-041-4/+2
| | | | | | | | codes under the DIAGNOSTICS section, not RETURN VALUES, which is for section 2, 3, and 9 manpages. Notes: svn path=/head/; revision=87360
* Actually I haven't enumerated the return values yet (thats why I hadn'tDavid E. O'Brien2001-12-041-1/+1
| | | | | | | | committed it yet). So vague'ize the wording a little bit to make up for it. Notes: svn path=/head/; revision=87328
* Default to WARNS=2.David E. O'Brien2001-12-041-0/+4
| | | | | | | | | Binary builds that cannot handle this must explicitly set WARNS=0. Reviewed by: mike Notes: svn path=/head/; revision=87325
* Remove whitespace at EOL.Dima Dorfman2001-07-151-11/+11
| | | | Notes: svn path=/head/; revision=79754
* mdoc(7) police:Ruslan Ermilov2001-04-271-3/+3
| | | | | | | document date updated, removed history info from the .Os call, cosmetics. Notes: svn path=/head/; revision=76063
* Add support for the -F flag which determines whether a specifiedKirk McKusick2001-04-241-54/+35
| | | | | | | | | | | | | | | filesystem needs foreground checking (usually at boot time) or can defer to background checking (after the system is up and running). See the manual page, fsck_ffs(8), for details on the -F and -B options. These options are primarily intended for use by the fsck front end. All output is directed to stdout so that the output is coherent when redirected to a file or a pipe. Unify the code with the fsck front end that allows either a device or a mount point to be specified as the argument to be checked. Notes: svn path=/head/; revision=75927
* mdoc(7) police: prepare for mdocNG.Ruslan Ermilov2001-04-161-1/+1
| | | | Notes: svn path=/head/; revision=75545
* Use ".Nm fsck_ffs", so that this turns up in whatis(1), and others.Nik Clayton2001-02-121-2/+4
| | | | | | | | | | Add .Xr to fsck. Prompted by: JM Jr's script that shows binaries with no whatis info Reviewed by: adrian Notes: svn path=/head/; revision=72417
* Document fsck_ffs's new SIGINFO handler.Ian Dowse2001-01-031-0/+12
| | | | | | | Reviewed by: sheldonh Notes: svn path=/head/; revision=70633
* Prepare for mdoc(7)NG.Ruslan Ermilov2000-12-181-4/+5
| | | | Notes: svn path=/head/; revision=70152
* mdoc(7) police: use the new features of the Nm macro.Ruslan Ermilov2000-11-201-5/+5
| | | | Notes: svn path=/head/; revision=68960
* $Id$ -> $FreeBSD$Peter Wemm1999-08-281-1/+1
| | | | Notes: svn path=/head/; revision=50476
* Cosmetic and documentation changes brought from earlier FreeBSD versions.Julian Elischer1998-12-031-18/+26
| | | | | | | (e.g. RCS Id:) Notes: svn path=/head/; revision=41477
* Reviewed by: Don Lewis <Don.Lewis@tsc.tdk.com>Julian Elischer1998-12-031-54/+58
| | | | | | | | | | | | | | | Submitted by: Kirk McKusick <mckusick@McKusick.COM> Obtained from: Mckusick, BSDI and a host of others This exactly matches Kirks sources imported under the Tag MCKUSICK2. These are as supplied by kirk with one small change needed to compile under freeBSD. Some FreeBSD patches will be added back, though many have been added to Kirk's sources already. Notes: svn path=/head/; revision=41474
* Correct use of .Nm. Add rcsid. Remove unused #includes. Use err(3).Philippe Charnier1998-06-151-16/+16
| | | | Notes: svn path=/head/; revision=37000
* Restored lost reference to fsdb(8).Bruce Evans1997-03-121-1/+2
| | | | | | | Fixed weird quoting of $Id$. Notes: svn path=/head/; revision=23794
* Merge from Lite2. Note that Lite2 has it's own filesystem clean checkPeter Wemm1997-03-111-5/+14
| | | | | | | | skipping code that overrides ours sooner. One should be eliminated, but for now it works. Notes: svn path=/head/; revision=23675
* Revert $FreeBSD$ to $Id$Peter Wemm1997-02-221-1/+1
| | | | Notes: svn path=/head/; revision=22990
* Make the long-awaited change from $Id$ to $FreeBSD$Jordan K. Hubbard1997-01-141-1/+1
| | | | | | | | | | | This will make a number of things easier in the future, as well as (finally!) avoiding the Id-smashing problem which has plagued developers for so long. Boy, I'm glad we're not using sup anymore. This update would have been insane otherwise. Notes: svn path=/head/; revision=21673
* Sort cross references.Wolfram Schneider1997-01-131-1/+2
| | | | Notes: svn path=/head/; revision=21635