search

jessek / hashdeep

Other
694 stars 130 forks source link

md5deep hang #336

Closed magoo closed 9 years ago

magoo commented 9 years ago

When running: sudo md5deep -r /mnt/ssh_hashtable_compare/ > sshhashtable_compare.mdeep, I get a hang until I kill. I'm running it against a volume of an EC2 snapshot. Looks like the output data is similar to md5sum though (running correctly)

instance details

ubuntu@examiner:~$ uname -a Linux examiner 3.16.0-41-generic #57-Ubuntu SMP Thu Jun 18 08:44:16 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux ubuntu@examiner:~$ lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 14.10 Release: 14.10 Codename: utopic ubuntu@examiner:~$ md5deep -h | grep version md5deep version 4.2 by Jesse Kornblum and Simson Garfinkel. ubuntu@examiner:~$ mount /dev/xvda1 on / type ext4 (rw,discard) proc on /proc type proc (rw,nodev,noexec,nosuid) sysfs on /sys type sysfs (rw,nodev,noexec,nosuid) none on /sys/fs/cgroup type tmpfs (rw,uid=0,gid=0,mode=0755,size=1024) none on /sys/fs/fuse/connections type fusectl (rw) none on /sys/kernel/debug type debugfs (rw) none on /sys/kernel/security type securityfs (rw) udev on /dev type devtmpfs (rw,mode=0755) devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620) tmpfs on /run type tmpfs (rw,noexec,nosuid,size=10%,mode=0755) none on /run/lock type tmpfs (rw,nodev,noexec,nosuid,size=5242880) none on /run/shm type tmpfs (rw,nosuid,nodev) none on /run/user type tmpfs (rw,nodev,noexec,nosuid,size=104857600,mode=0755) none on /sys/fs/pstore type pstore (rw) /dev/xvdf on /mnt/investigate type ext4 (rw) systemd on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,noexec,nodev,none,name=systemd) /dev/xvdj1 on /mnt/ssh_hashtable type ext4 (ro) /dev/xvdk1 on /mnt/ssh_hashtable_compare type ext4 (ro) ubuntu@examiner:~$ lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT xvda 202:0 0 8G 0 disk └─xvda1 202:1 0 8G 0 part / xvdf 202:80 0 100G 0 disk /mnt/investigate xvdg 202:96 0 8G 0 disk └─xvdg1 202:97 0 8G 0 part xvdh 202:112 0 1G 0 disk xvdi 202:128 0 8G 0 disk └─xvdi1 202:129 0 8G 0 part xvdj 202:144 0 8G 0 disk └─xvdj1 202:145 0 8G 0 part /mnt/ssh_hashtable xvdk 202:160 0 8G 0 disk └─xvdk1 202:161 0 8G 0 part /mnt/ssh_hashtable_compare

jessek commented 9 years ago

What does the output look like? Can you run ls -lR on the directory?

magoo commented 9 years ago

I can run ls -lR on /mnt/ssh_hashtable (and _compare) with clean exits

The output appears to be OK, but the hang is worrisome and stops with a FUTEX_WAIT_PRIVATE call observed by strace, can't be sure it actually finished despite the output being exact to md5sum's work.

I tried doing a similar -r lookup with a matchfile, and noticed it hangs similarly.

Here's the final system calls from strace before the hang lstat("/mnt/ssh_hashtable_compare/dev/dsp", {st_mode=S_IFCHR|0660, st_rdev=makedev(14, 3), ...}) = 0 futex(0xa6d90c, FUTEX_WAIT_PRIVATE, 208711, NULL

magoo commented 9 years ago

These two files cause md5deep to hang

lrwxrwxrwx 1 root root 11 Mar 25 11:50 core -> /proc/kcore prw-r----- 1 root adm 0 Mar 25 11:50 xconsole

Inspecting ubuntu@examiner:~$ file /mnt/ssh_hashtable_compare/dev/core /mnt/ssh_hashtable_compare/dev/core: symbolic link to /proc/kcore' ubuntu@examiner:~$ file /mnt/ssh_hashtable_compare/dev/xcon /mnt/ssh_hashtable_compare/dev/xconsole: fifo (named pipe)

It looks as if it causes md5sum to hang as well, which I missed earlier. So this doesn't seem to be a md5deep problem. Closing.