On Tue, 26 Oct 2004 16:53:47 -0400 (EDT), Robert P. J. Day <rpjday@xxxxxxxxxxxxxx> wrote: > On Tue, 26 Oct 2004, Alexandre Oliva wrote: > > > On Oct 26, 2004, Alexandre Strube <surak@xxxxxxxxxxxxxxxxx> wrote: > > > > > The ntfs module used in other distributions is mainly read-only... how > > > can this corrupt a file system? > > > > All it takes is a bit of incorrect memory management in the kernel. > > As soon as you corrupt kernel data structures, all bets are off. Say, > > double-free of a pointer to an ntfs read-only buffer could corrupt > > whatever data structure that buffer was being reused for after the > > first free. > > i've always wondered about this -- i still don't see how that could > corrupt the NTFS structure *on* *disk*. sure, it's entirely possible > that the cached NTFS info in RAM might get screwed, you might lose the > ability to *read* files from the hard drive. but i don't see how that > equates to actually *damaging* the contents on the hard drive. > > if i mount a filesystem read-only, i expect it never to be altered. > doesn't NTFS use the same VFS layer as everyone else? shouldn't > "readonly" mounting be respected by that layer? > When I worked at Red Hat support... we were able to duplicate the corruption on read-only. This would have been 1999 or so. I remember retrying it around 2001 and also having to reinstall my Windows 2000 stuff after doing a very large grep. The only thing that I could figure out at that time was that something like the journal wasnt being mounted read-only and that corrupted the disk... but I am so far out of my league beyond.. hmm it broke. There were issues that Microsoft said they had patents in NTFS in various news articles but no-one in support could correlate what patents they were saying and how 'enforceable they were'. This is all before July 2001. After that.. I have no idea what RH wanted to do. -- Stephen J Smoogen. CSIRT/Linux System Administrator