summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChangqing Li <changqing.li@windriver.com>2019-11-04 14:13:59 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-11-13 22:02:15 +0000
commit2d43b1e2f138bb2a39041feb2f78098bbdc34ee8 (patch)
tree6951b52ae8a1131ef0bcfdafbab5368d92830a61
parentf9d4afbb06d078734a77b803d15ab32166f510d1 (diff)
downloadpoky-2d43b1e2f138bb2a39041feb2f78098bbdc34ee8.tar.gz
e2fsprogs: fix CVE-2019-5094
(From OE-Core rev: 56f38b042d68528009283491b9d40c75f13b8f16) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat
-rw-r--r--meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2019-5094.patch217
-rw-r--r--meta/recipes-devtools/e2fsprogs/e2fsprogs_1.45.3.bb1
2 files changed, 218 insertions, 0 deletions
diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2019-5094.patch b/meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2019-5094.patch
new file mode 100644
index 0000000000..56925cbd4b
--- /dev/null
+++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs/CVE-2019-5094.patch
@@ -0,0 +1,217 @@
1From 8dbe7b475ec5e91ed767239f0e85880f416fc384 Mon Sep 17 00:00:00 2001
2From: Theodore Ts'o <tytso@mit.edu>
3Date: Sun, 1 Sep 2019 00:59:16 -0400
4Subject: libsupport: add checks to prevent buffer overrun bugs in quota code
5
6A maliciously corrupted file systems can trigger buffer overruns in
7the quota code used by e2fsck. To fix this, add sanity checks to the
8quota header fields as well as to block number references in the quota
9tree.
10
11Addresses: CVE-2019-5094
12Addresses: TALOS-2019-0887
13Signed-off-by: Theodore Ts'o <tytso@mit.edu>
14
15
16Upstream-Status: Backport [https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/commit/?h=maint&id=8dbe7b475ec5e91ed767239f0e85880f416fc384]
17CVE: CVE-2019-5094
18
19Signed-off-by: Changqing Li <changqing.li@windriver.com>
20---
21 lib/support/mkquota.c | 1 +
22 lib/support/quotaio_tree.c | 71 ++++++++++++++++++++++++++++++----------------
23 lib/support/quotaio_v2.c | 28 ++++++++++++++++++
24 3 files changed, 76 insertions(+), 24 deletions(-)
25
26diff --git a/lib/support/mkquota.c b/lib/support/mkquota.c
27index 0b9e7665..ddb53124 100644
28--- a/lib/support/mkquota.c
29+++ b/lib/support/mkquota.c
30@@ -671,6 +671,7 @@ errcode_t quota_compare_and_update(quota_ctx_t qctx, enum quota_type qtype,
31 err = qh.qh_ops->scan_dquots(&qh, scan_dquots_callback, &scan_data);
32 if (err) {
33 log_debug("Error scanning dquots");
34+ *usage_inconsistent = 1;
35 goto out_close_qh;
36 }
37
38diff --git a/lib/support/quotaio_tree.c b/lib/support/quotaio_tree.c
39index a7c2028c..6cc4fb5b 100644
40--- a/lib/support/quotaio_tree.c
41+++ b/lib/support/quotaio_tree.c
42@@ -540,6 +540,17 @@ struct dquot *qtree_read_dquot(struct quota_handle *h, qid_t id)
43 return dquot;
44 }
45
46+static int check_reference(struct quota_handle *h, unsigned int blk)
47+{
48+ if (blk >= h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks) {
49+ log_err("Illegal reference (%u >= %u) in %s quota file",
50+ blk, h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks,
51+ quota_type2name(h->qh_type));
52+ return -1;
53+ }
54+ return 0;
55+}
56+
57 /*
58 * Scan all dquots in file and call callback on each
59 */
60@@ -558,7 +569,7 @@ static int report_block(struct dquot *dquot, unsigned int blk, char *bitmap,
61 int entries, i;
62
63 if (!buf)
64- return 0;
65+ return -1;
66
67 set_bit(bitmap, blk);
68 read_blk(dquot->dq_h, blk, buf);
69@@ -580,23 +591,12 @@ static int report_block(struct dquot *dquot, unsigned int blk, char *bitmap,
70 return entries;
71 }
72
73-static void check_reference(struct quota_handle *h, unsigned int blk)
74-{
75- if (blk >= h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks)
76- log_err("Illegal reference (%u >= %u) in %s quota file. "
77- "Quota file is probably corrupted.\n"
78- "Please run e2fsck (8) to fix it.",
79- blk,
80- h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks,
81- quota_type2name(h->qh_type));
82-}
83-
84 static int report_tree(struct dquot *dquot, unsigned int blk, int depth,
85 char *bitmap,
86 int (*process_dquot) (struct dquot *, void *),
87 void *data)
88 {
89- int entries = 0, i;
90+ int entries = 0, ret, i;
91 dqbuf_t buf = getdqbuf();
92 __le32 *ref = (__le32 *) buf;
93
94@@ -607,22 +607,40 @@ static int report_tree(struct dquot *dquot, unsigned int blk, int depth,
95 if (depth == QT_TREEDEPTH - 1) {
96 for (i = 0; i < QT_BLKSIZE >> 2; i++) {
97 blk = ext2fs_le32_to_cpu(ref[i]);
98- check_reference(dquot->dq_h, blk);
99- if (blk && !get_bit(bitmap, blk))
100- entries += report_block(dquot, blk, bitmap,
101- process_dquot, data);
102+ if (check_reference(dquot->dq_h, blk)) {
103+ entries = -1;
104+ goto errout;
105+ }
106+ if (blk && !get_bit(bitmap, blk)) {
107+ ret = report_block(dquot, blk, bitmap,
108+ process_dquot, data);
109+ if (ret < 0) {
110+ entries = ret;
111+ goto errout;
112+ }
113+ entries += ret;
114+ }
115 }
116 } else {
117 for (i = 0; i < QT_BLKSIZE >> 2; i++) {
118 blk = ext2fs_le32_to_cpu(ref[i]);
119 if (blk) {
120- check_reference(dquot->dq_h, blk);
121- entries += report_tree(dquot, blk, depth + 1,
122- bitmap, process_dquot,
123- data);
124+ if (check_reference(dquot->dq_h, blk)) {
125+ entries = -1;
126+ goto errout;
127+ }
128+ ret = report_tree(dquot, blk, depth + 1,
129+ bitmap, process_dquot,
130+ data);
131+ if (ret < 0) {
132+ entries = ret;
133+ goto errout;
134+ }
135+ entries += ret;
136 }
137 }
138 }
139+errout:
140 freedqbuf(buf);
141 return entries;
142 }
143@@ -642,6 +660,7 @@ int qtree_scan_dquots(struct quota_handle *h,
144 int (*process_dquot) (struct dquot *, void *),
145 void *data)
146 {
147+ int ret;
148 char *bitmap;
149 struct v2_mem_dqinfo *v2info = &h->qh_info.u.v2_mdqi;
150 struct qtree_mem_dqinfo *info = &v2info->dqi_qtree;
151@@ -655,10 +674,14 @@ int qtree_scan_dquots(struct quota_handle *h,
152 ext2fs_free_mem(&dquot);
153 return -1;
154 }
155- v2info->dqi_used_entries = report_tree(dquot, QT_TREEOFF, 0, bitmap,
156- process_dquot, data);
157+ ret = report_tree(dquot, QT_TREEOFF, 0, bitmap, process_dquot, data);
158+ if (ret < 0)
159+ goto errout;
160+ v2info->dqi_used_entries = ret;
161 v2info->dqi_data_blocks = find_set_bits(bitmap, info->dqi_blocks);
162+ ret = 0;
163+errout:
164 ext2fs_free_mem(&bitmap);
165 ext2fs_free_mem(&dquot);
166- return 0;
167+ return ret;
168 }
169diff --git a/lib/support/quotaio_v2.c b/lib/support/quotaio_v2.c
170index 38be2a34..73906676 100644
171--- a/lib/support/quotaio_v2.c
172+++ b/lib/support/quotaio_v2.c
173@@ -175,6 +175,8 @@ static int v2_check_file(struct quota_handle *h, int type, int fmt)
174 static int v2_init_io(struct quota_handle *h)
175 {
176 struct v2_disk_dqinfo ddqinfo;
177+ struct v2_mem_dqinfo *info;
178+ __u64 filesize;
179
180 h->qh_info.u.v2_mdqi.dqi_qtree.dqi_entry_size =
181 sizeof(struct v2r1_disk_dqblk);
182@@ -185,6 +187,32 @@ static int v2_init_io(struct quota_handle *h)
183 sizeof(ddqinfo)) != sizeof(ddqinfo))
184 return -1;
185 v2_disk2memdqinfo(&h->qh_info, &ddqinfo);
186+
187+ /* Check to make sure quota file info is sane */
188+ info = &h->qh_info.u.v2_mdqi;
189+ if (ext2fs_file_get_lsize(h->qh_qf.e2_file, &filesize))
190+ return -1;
191+ if ((filesize > (1U << 31)) ||
192+ (info->dqi_qtree.dqi_blocks >
193+ (filesize + QT_BLKSIZE - 1) >> QT_BLKSIZE_BITS)) {
194+ log_err("Quota inode %u corrupted: file size %llu; "
195+ "dqi_blocks %u", h->qh_qf.ino,
196+ filesize, info->dqi_qtree.dqi_blocks);
197+ return -1;
198+ }
199+ if (info->dqi_qtree.dqi_free_blk >= info->dqi_qtree.dqi_blocks) {
200+ log_err("Quota inode %u corrupted: free_blk %u; dqi_blocks %u",
201+ h->qh_qf.ino, info->dqi_qtree.dqi_free_blk,
202+ info->dqi_qtree.dqi_blocks);
203+ return -1;
204+ }
205+ if (info->dqi_qtree.dqi_free_entry >= info->dqi_qtree.dqi_blocks) {
206+ log_err("Quota inode %u corrupted: free_entry %u; "
207+ "dqi_blocks %u", h->qh_qf.ino,
208+ info->dqi_qtree.dqi_free_entry,
209+ info->dqi_qtree.dqi_blocks);
210+ return -1;
211+ }
212 return 0;
213 }
214
215--
216cgit 1.2-0.3.lf.el7
217
diff --git a/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.45.3.bb b/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.45.3.bb
index fdc9454b58..14c05a446c 100644
--- a/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.45.3.bb
+++ b/meta/recipes-devtools/e2fsprogs/e2fsprogs_1.45.3.bb
@@ -5,6 +5,7 @@ SRC_URI += "file://remove.ldconfig.call.patch \
5 file://ptest.patch \ 5 file://ptest.patch \
6 file://mkdir_p.patch \ 6 file://mkdir_p.patch \
7 file://0001-misc-create_inode.c-set-dir-s-mode-correctly.patch \ 7 file://0001-misc-create_inode.c-set-dir-s-mode-correctly.patch \
8 file://CVE-2019-5094.patch \
8 " 9 "
9 10
10SRC_URI_append_class-native = " file://e2fsprogs-fix-missing-check-for-permission-denied.patch \ 11SRC_URI_append_class-native = " file://e2fsprogs-fix-missing-check-for-permission-denied.patch \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-27 21:37:41 +0000