"Fedora 14 Beta corrupts user data" - should we be worried?

[vpvfi]

The following thread was recently posted to the Fedora devel mailing list: http://lists.fedoraproject.org/pipermail/devel/2010-September/143427.html

John Reiser: Compiled code for minimum(), maximum(), etc. suffers from a compiler bug:
https://bugzilla.redhat.com/show_bug.cgi?id=634757 -O1 wrong-code by cmove
Unfortunately this bug can corrupt user data silently.

I have hit the bug three times myself (bz 635508, 637303, 637461)
and consider myself lucky that the bad effects were evident and ignorable.

A fix is in testing, and a critical path update has been approved:
https://admin.fedoraproject.org/updates/gcc-4.5.1-4.fc14
IMNSHO this will require a mass rebuild of all architecture-specific
.fc14 .rpm.

Meanwhile, do not use Fedora 14 Beta on data that you value (e-mail,
documents, database, etc.) It really is that dangerous.


This post apparently has the list of affected packages: http://lists.fedoraproject.org/pipermail/devel/2010-September/143432.html

The Beta release is supposed to happen today and I haven't seen a coordinated effort of rebuilding these packages. If the risk of data loss is indeed real, I think the Beta testers should be warned on the website. I've usually updated all my systems to the Beta releases, but now I'm thinking I probably shouldn't.

[AdamW]

Okay, so honestly, I really don't know for sure the impact of this bug. I know none of my data is corrupted (or, at least, the data I've accessed lately :>). That's about it. I do know we're working on a rebuild of all potentially affected packages in F14 and Rawhide trees. For now I guess just take the usual warnings about pre-releases - may eat your brains, etc - seriously.

[steelaworkn]

Okay, so honestly, I really don't know for sure the impact of this bug. I know none of my data is corrupted (or, at least, the data I've accessed lately :>). That's about it. I do know we're working on a rebuild of all potentially affected packages in F14 and Rawhide trees. For now I guess just take the usual warnings about pre-releases - may eat your brains, etc - seriously.


So, do most beta testers have a couple of machines with different builds instead of testing the new OS out on a "daily driver"?

[AdamW]

that's how you're supposed to do it, yes. or use a spare partition - though that's not much help with a potential data corruption bug, I guess - or a VM.

(all of my machines run fedora 14 exclusively. but hey, I would never recommend anyone emulate me in any way. :>)

[dd_wizard]

@ AdamW:

Do you know, or can you tell me how to find out, when packages started being built with gcc-4.5.1-4.fc14? The query in the package list post (http://lists.fedoraproject.org/pipermail/devel/2010-September/143432.html) contains the following caveat:
The script generates a list of packages which were built later than
gcc-4.5.1-3.fc14 and require 'rtld(GNU_HASH)'. The list is open ended as
the fixed -4 build doesn't appear to be in buildroots as I am typing this.

I modified the query to list installed packages. However, due to the above caveat, packages built with the fixed -4 gcc show up as false positives.

Thanks,
dd_wizard

---------- Post added at 04:54 PM CDT ---------- Previous post was at 02:06 PM CDT ----------

I think I answered my question, AdamW. I queried the repos and my installed packages and sorted the results by %{buildtime}. From the build root.logs, it looks like the transition to gcc-4.5.1-4.fc14 occured sometime between the buildtime for:

%{buildtime} package
1285532327 qbittorrent-2.4.2-1.fc14.src.rpm
1285565599 clementine-0.5.2-1.fc14.src.rpm

Interestingly, kernel-2.6.35.6-34.fc14 is the first kernel since kernel-2.6.35.4-25.fc14 that wasn't built with the buggy compiler. See this post (http://forums.fedoraforum.org/showthread.php?t=252220).

EDIT: The bug report only mentions the x86_64 compiler. Does this mean only 64 bit systems are impacted? Either way, I'm at risk since I'm running 64 bit Fedora.

dd_wizard

[diamond_ramsey]

...The Beta release is supposed to happen today and I haven't seen a coordinated effort of rebuilding these packages. If the risk of data loss is indeed real, I think the Beta testers should be warned on the website. I've usually updated all my systems to the Beta releases, but now I'm thinking I probably shouldn't.

vpvfi, I have the 32-bit Beta running a few machines and I have not experienced any loss of data during these installs. :)
==================================================
Hope this helps. ;)

[vpvfi]

Today's Rawhide report (http://lists.fedoraproject.org/pipermail/devel/2010-September/143585.html) has a bunch of packages rebuilt due to this bug. Now I'm just waiting for the similar rebuilds to hit F14 updates-testing ;)

Edit: Now these rebuilds are also being submitted to updates-testing (http://lists.fedoraproject.org/pipermail/test/2010-September/094284.html). It seems we'll soon be out of the woods.

[vpvfi]

Jesse Keating just announced that the coordinated rebuilds for F14 are being done now: http://lists.fedoraproject.org/pipermail/devel-announce/2010-October/000698.html

[LightDot]

That's good to know! Still about 70 potentially buggy packages on my installation, elfutils, make, python, tar, bzip2 etc. among others...

[Icm76]

Not sure if I've been affected by this, but I have lost a several folders of photographs, old correspondence, Firefox bookmarks & add-on settings, as well as other odds & ends that I'm not quite sure about - I've got a lot of empty folders that I don't remember exactly what was in them. However my issue may be due to a virus on the Windows side of my system - Avira started quarantining many files and it looked pretty bad to me, so I tried to get a Linux Live CD running so that I could back up my data and wipe all the hard drives. As it turned out F14 was the first Live CD I could get working on my PC dues to ATi 5850 problems.

I created a new Ext3 partition with the F14 Live CD and copied the data I wanted to keep, but some of it is missing. The most obvious was the Firefox addon settings which I backed up just before the copy - that whole folder was empty when I went back to re load the settings on the fresh system.



EDIT: I do have backups from 2-3 months ago, so this isn't a total catastrophe, but virus writers should be burned at the stake for the hassle they cause.

[vpvfi]

It seems to me like the rebuilds done by Jesse are now hitting F14 stable and/or F14 updates-testing. I just had a bunch of them installed when doing yum update.