Re: hfsplus volume suddenly inaccessable after 'hfs: recoff %d too large'

[Vyacheslav Dubeyko <slava@dubeyko.com>]

Hi Michael,

On Apr 5, 2013, at 9:01 AM, Michael Fox wrote:

> Hi Vyacheslav. Thanks for getting back so quickly.
> 
> /proc/partitions is:
> 
> major minor  #blocks  name
> 
>   8        0  234431064 sda
>   8        1     204800 sda1
>   8        2   51200000 sda2
>   8        3     204800 sda3
>   8        4     843776 sda4
>   8        5   97656248 sda5
>   8        6    4102144 sda6
>   8        7   80215040 sda7
>   8        8       2631 sda8
> 
> mount is:
> 
> /dev/sda2 on / type ext4 (rw,errors=remount-ro)
> proc on /proc type proc (rw,noexec,nosuid,nodev)
> sysfs on /sys type sysfs (rw,noexec,nosuid,nodev)
> none on /sys/fs/fuse/connections type fusectl (rw)
> none on /sys/kernel/debug type debugfs (rw)
> none on /sys/kernel/security type securityfs (rw)
> udev on /dev type devtmpfs (rw,mode=0755)
> devpts on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
> tmpfs on /run type tmpfs (rw,noexec,nosuid,size=10%,mode=0755)
> none on /run/lock type tmpfs (rw,noexec,nosuid,nodev,size=5242880)
> none on /run/shm type tmpfs (rw,nosuid,nodev)
> none on /run/user type tmpfs (rw,noexec,nosuid,nodev,size=104857600,mode=0755)
> cgroup on /sys/fs/cgroup type tmpfs (rw,relatime,mode=755)
> cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,relatime,cpuset)
> cgroup on /sys/fs/cgroup/cpu type cgroup (rw,relatime,cpu)
> cgroup on /sys/fs/cgroup/cpuacct type cgroup (rw,relatime,cpuacct)
> cgroup on /sys/fs/cgroup/memory type cgroup (rw,relatime,memory)
> cgroup on /sys/fs/cgroup/devices type cgroup (rw,relatime,devices)
> cgroup on /sys/fs/cgroup/freezer type cgroup (rw,relatime,freezer)
> cgroup on /sys/fs/cgroup/blkio type cgroup (rw,relatime,blkio)
> cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,relatime,perf_event)
> cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,relatime,hugetlb)
> binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc
> (rw,noexec,nosuid,nodev)
> rpc_pipefs on /run/rpc_pipefs type rpc_pipefs (rw)
> /dev/sda7 on /home/m/hfsshare type hfsplus (rw,uid=1000,gid=1000,user=m)
> /dev/sda5 on /mnt/air type hfsplus (ro,user=m)
> 
> The one that crashed is /dev/sda5.
> 
> The hfsplus volume came with the macbook but got resized by OSX before
> the Linux install, then it got dd copied to a new drive. Then it got
> resized again by OSX. And there was an episode where I lost the
> partition table but got it back. I guess something could have gone
> wrong in all that but this is the first time I have had a crash like
> this and it's been stable for a few months.
> 
> The content of the volume is normal OSX stuff. Nothing top-secret.
> Maybe a few private keys I wouldn't want to post on the internet but
> I'm happy to provide metadata if you can instruct me how to dump it.
> 

Thank you for additional details.

I need a some time for investigation of crash's output with the goal of achieving a deeper understanding of the issue.

Maybe, the dump of superblock of HFS+ volume on /dev/sda5 device can be helpful too for beginning. You can dump superblock by means of "sudo dd if=/dev/sda5 of=./<dump_file_name> bs=4096 count=1". Please, dump the superblock and share it. You can send this dump only on my e-mail address.

Thanks,
Vyacheslav Dubeyko.

> My usage under OSX is pretty minimal -- I haven't booted it in months
> but sometimes I mount it when I'm looking for a file I haven't used in
> a while and think that it might be there.
> 
> OSX version is 10.7 Lion.
>