summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/e2fsprogs/e2fsprogs
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-devtools/e2fsprogs/e2fsprogs')
-rw-r--r--meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-e2fsck-don-t-try-to-rehash-a-deleted-directory.patch49
-rw-r--r--meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2019-5188.patch57
-rw-r--r--meta/recipes-devtools/e2fsprogs/e2fsprogs/e2fsck-fix-use-after-free-in-calculate_tree.patch76
3 files changed, 182 insertions, 0 deletions
diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-e2fsck-don-t-try-to-rehash-a-deleted-directory.patch b/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-e2fsck-don-t-try-to-rehash-a-deleted-directory.patch
new file mode 100644
index 0000000000..ba4e3a3c97
--- /dev/null
+++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs/0001-e2fsck-don-t-try-to-rehash-a-deleted-directory.patch
@@ -0,0 +1,49 @@
1From 71ba13755337e19c9a826dfc874562a36e1b24d3 Mon Sep 17 00:00:00 2001
2From: Theodore Ts'o <tytso@mit.edu>
3Date: Thu, 19 Dec 2019 19:45:06 -0500
4Subject: [PATCH] e2fsck: don't try to rehash a deleted directory
5
6If directory has been deleted in pass1[bcd] processing, then we
7shouldn't try to rehash the directory in pass 3a when we try to
8rehash/reoptimize directories.
9
10Signed-off-by: Theodore Ts'o <tytso@mit.edu>
11
12Upstream-Status: Backport [https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/?id=71ba13755337e19c9a826dfc874562a36e1b24d3]
13Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
14---
15 e2fsck/pass1b.c | 4 ++++
16 e2fsck/rehash.c | 2 ++
17 2 files changed, 6 insertions(+)
18
19diff --git a/e2fsck/pass1b.c b/e2fsck/pass1b.c
20index 5693b9cf..bca701ca 100644
21--- a/e2fsck/pass1b.c
22+++ b/e2fsck/pass1b.c
23@@ -705,6 +705,10 @@ static void delete_file(e2fsck_t ctx, ext2_ino_t ino,
24 fix_problem(ctx, PR_1B_BLOCK_ITERATE, &pctx);
25 if (ctx->inode_bad_map)
26 ext2fs_unmark_inode_bitmap2(ctx->inode_bad_map, ino);
27+ if (ctx->inode_reg_map)
28+ ext2fs_unmark_inode_bitmap2(ctx->inode_reg_map, ino);
29+ ext2fs_unmark_inode_bitmap2(ctx->inode_dir_map, ino);
30+ ext2fs_unmark_inode_bitmap2(ctx->inode_used_map, ino);
31 ext2fs_inode_alloc_stats2(fs, ino, -1, LINUX_S_ISDIR(dp->inode.i_mode));
32 quota_data_sub(ctx->qctx, &dp->inode, ino,
33 pb.dup_blocks * fs->blocksize);
34diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
35index 3dd1e941..2c908be0 100644
36--- a/e2fsck/rehash.c
37+++ b/e2fsck/rehash.c
38@@ -1028,6 +1028,8 @@ void e2fsck_rehash_directories(e2fsck_t ctx)
39 if (!ext2fs_u32_list_iterate(iter, &ino))
40 break;
41 }
42+ if (!ext2fs_test_inode_bitmap2(ctx->inode_dir_map, ino))
43+ continue;
44
45 pctx.dir = ino;
46 if (first) {
47--
482.24.1
49
diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2019-5188.patch b/meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2019-5188.patch
new file mode 100644
index 0000000000..de4bce0037
--- /dev/null
+++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2019-5188.patch
@@ -0,0 +1,57 @@
1From 8dd73c149f418238f19791f9d666089ef9734dff Mon Sep 17 00:00:00 2001
2From: Theodore Ts'o <tytso@mit.edu>
3Date: Thu, 19 Dec 2019 19:37:34 -0500
4Subject: [PATCH] e2fsck: abort if there is a corrupted directory block when
5 rehashing
6
7In e2fsck pass 3a, when we are rehashing directories, at least in
8theory, all of the directories should have had corruptions with
9respect to directory entry structure fixed. However, it's possible
10(for example, if the user declined a fix) that we can reach this stage
11of processing with a corrupted directory entries.
12
13So check for that case and don't try to process a corrupted directory
14block so we don't run into trouble in mutate_name() if there is a
15zero-length file name.
16
17Addresses: TALOS-2019-0973
18Addresses: CVE-2019-5188
19Signed-off-by: Theodore Ts'o <tytso@mit.edu>
20
21CVE: CVE-2019-5188
22Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
23Upstream-Status: Backport [https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/?id=8dd73c149f418238f19791f9d666089ef9734dff]
24---
25 e2fsck/rehash.c | 9 +++++++++
26 1 file changed, 9 insertions(+)
27
28diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
29index a5fc1be1..3dd1e941 100644
30--- a/e2fsck/rehash.c
31+++ b/e2fsck/rehash.c
32@@ -160,6 +160,10 @@ static int fill_dir_block(ext2_filsys fs,
33 dir_offset += rec_len;
34 if (dirent->inode == 0)
35 continue;
36+ if ((name_len) == 0) {
37+ fd->err = EXT2_ET_DIR_CORRUPTED;
38+ return BLOCK_ABORT;
39+ }
40 if (!fd->compress && (name_len == 1) &&
41 (dirent->name[0] == '.'))
42 continue;
43@@ -401,6 +405,11 @@ static int duplicate_search_and_fix(e2fsck_t ctx, ext2_filsys fs,
44 continue;
45 }
46 new_len = ext2fs_dirent_name_len(ent->dir);
47+ if (new_len == 0) {
48+ /* should never happen */
49+ ext2fs_unmark_valid(fs);
50+ continue;
51+ }
52 memcpy(new_name, ent->dir->name, new_len);
53 mutate_name(new_name, &new_len);
54 for (j=0; j < fd->num_array; j++) {
55--
562.24.1
57
diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs/e2fsck-fix-use-after-free-in-calculate_tree.patch b/meta/recipes-devtools/e2fsprogs/e2fsprogs/e2fsck-fix-use-after-free-in-calculate_tree.patch
new file mode 100644
index 0000000000..342a2b855b
--- /dev/null
+++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs/e2fsck-fix-use-after-free-in-calculate_tree.patch
@@ -0,0 +1,76 @@
1From: Wang Shilong <wshilong@ddn.com>
2Date: Mon, 30 Dec 2019 19:52:39 -0500
3Subject: e2fsck: fix use after free in calculate_tree()
4
5The problem is alloc_blocks() will call get_next_block() which might
6reallocate outdir->buf, and memory address could be changed after
7this. To fix this, pointers that point into outdir->buf, such as
8int_limit and root need to be recaulated based on the new starting
9address of outdir->buf.
10
11[ Changed to correctly recalculate int_limit, and to optimize how we
12 reallocate outdir->buf. -TYT ]
13
14Addresses-Debian-Bug: 948517
15Signed-off-by: Wang Shilong <wshilong@ddn.com>
16Signed-off-by: Theodore Ts'o <tytso@mit.edu>
17(cherry picked from commit 101e73e99ccafa0403fcb27dd7413033b587ca01)
18
19Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
20Upstream-Status: Backport [https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/?id=101e73e99ccafa0403fcb27dd7413033b587ca01]
21---
22 e2fsck/rehash.c | 17 ++++++++++++++++-
23 1 file changed, 16 insertions(+), 1 deletion(-)
24
25diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c
26index 0a5888a9..2574e151 100644
27--- a/e2fsck/rehash.c
28+++ b/e2fsck/rehash.c
29@@ -295,7 +295,11 @@ static errcode_t get_next_block(ext2_filsys fs, struct out_dir *outdir,
30 errcode_t retval;
31
32 if (outdir->num >= outdir->max) {
33- retval = alloc_size_dir(fs, outdir, outdir->max + 50);
34+ int increment = outdir->max / 10;
35+
36+ if (increment < 50)
37+ increment = 50;
38+ retval = alloc_size_dir(fs, outdir, outdir->max + increment);
39 if (retval)
40 return retval;
41 }
42@@ -637,6 +641,9 @@ static int alloc_blocks(ext2_filsys fs,
43 if (retval)
44 return retval;
45
46+ /* outdir->buf might be reallocated */
47+ *prev_ent = (struct ext2_dx_entry *) (outdir->buf + *prev_offset);
48+
49 *next_ent = set_int_node(fs, block_start);
50 *limit = (struct ext2_dx_countlimit *)(*next_ent);
51 if (next_offset)
52@@ -726,6 +733,9 @@ static errcode_t calculate_tree(ext2_filsys fs,
53 return retval;
54 }
55 if (c3 == 0) {
56+ int delta1 = (char *)int_limit - outdir->buf;
57+ int delta2 = (char *)root - outdir->buf;
58+
59 retval = alloc_blocks(fs, &limit, &int_ent,
60 &dx_ent, &int_offset,
61 NULL, outdir, i, &c2,
62@@ -733,6 +743,11 @@ static errcode_t calculate_tree(ext2_filsys fs,
63 if (retval)
64 return retval;
65
66+ /* outdir->buf might be reallocated */
67+ int_limit = (struct ext2_dx_countlimit *)
68+ (outdir->buf + delta1);
69+ root = (struct ext2_dx_entry *)
70+ (outdir->buf + delta2);
71 }
72 dx_ent->block = ext2fs_cpu_to_le32(i);
73 if (c3 != limit->limit)
74--
752.24.1
76
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-08 09:45:22 +0000