diff --git a/6000-e2fsck-abort-if-there-is-a-corrupted-directory-block.patch b/6000-e2fsck-abort-if-there-is-a-corrupted-directory-block.patch deleted file mode 100644 index 6acdb4857782da2838b9c9deac42e23683cd36f5..0000000000000000000000000000000000000000 --- a/6000-e2fsck-abort-if-there-is-a-corrupted-directory-block.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 8dd73c149f418238f19791f9d666089ef9734dff Mon Sep 17 00:00:00 2001 -From: Theodore Ts'o -Date: Thu, 19 Dec 2019 19:37:34 -0500 -Subject: [PATCH] e2fsck: abort if there is a corrupted directory block when - rehashing - -In e2fsck pass 3a, when we are rehashing directories, at least in -theory, all of the directories should have had corruptions with -respect to directory entry structure fixed. However, it's possible -(for example, if the user declined a fix) that we can reach this stage -of processing with a corrupted directory entries. - -So check for that case and don't try to process a corrupted directory -block so we don't run into trouble in mutate_name() if there is a -zero-length file name. - -Addresses: TALOS-2019-0973 -Addresses: CVE-2019-5188 -Signed-off-by: Theodore Ts'o ---- - e2fsck/rehash.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/e2fsck/rehash.c b/e2fsck/rehash.c -index a5fc1be..3dd1e94 100644 ---- a/e2fsck/rehash.c -+++ b/e2fsck/rehash.c -@@ -160,6 +160,10 @@ static int fill_dir_block(ext2_filsys fs, - dir_offset += rec_len; - if (dirent->inode == 0) - continue; -+ if ((name_len) == 0) { -+ fd->err = EXT2_ET_DIR_CORRUPTED; -+ return BLOCK_ABORT; -+ } - if (!fd->compress && (name_len == 1) && - (dirent->name[0] == '.')) - continue; -@@ -401,6 +405,11 @@ static int duplicate_search_and_fix(e2fsck_t ctx, ext2_filsys fs, - continue; - } - new_len = ext2fs_dirent_name_len(ent->dir); -+ if (new_len == 0) { -+ /* should never happen */ -+ ext2fs_unmark_valid(fs); -+ continue; -+ } - memcpy(new_name, ent->dir->name, new_len); - mutate_name(new_name, &new_len); - for (j=0; j < fd->num_array; j++) { --- -1.8.3.1 - diff --git a/6001-libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch b/6001-libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch deleted file mode 100644 index ffc224147e0ed02c3bcd6f1d5bd3dd4628ed6306..0000000000000000000000000000000000000000 --- a/6001-libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch +++ /dev/null @@ -1,212 +0,0 @@ -From 8dbe7b475ec5e91ed767239f0e85880f416fc384 Mon Sep 17 00:00:00 2001 -From: Theodore Ts'o -Date: Sun, 1 Sep 2019 00:59:16 -0400 -Subject: [PATCH] libsupport: add checks to prevent buffer overrun bugs in - quota code - -A maliciously corrupted file systems can trigger buffer overruns in -the quota code used by e2fsck. To fix this, add sanity checks to the -quota header fields as well as to block number references in the quota -tree. - -Addresses: CVE-2019-5094 -Addresses: TALOS-2019-0887 -Signed-off-by: Theodore Ts'o ---- - lib/support/mkquota.c | 1 + - lib/support/quotaio_tree.c | 71 ++++++++++++++++++++++++++++++---------------- - lib/support/quotaio_v2.c | 28 ++++++++++++++++++ - 3 files changed, 76 insertions(+), 24 deletions(-) - -diff --git a/lib/support/mkquota.c b/lib/support/mkquota.c -index 0b9e766..ddb5312 100644 ---- a/lib/support/mkquota.c -+++ b/lib/support/mkquota.c -@@ -671,6 +671,7 @@ errcode_t quota_compare_and_update(quota_ctx_t qctx, enum quota_type qtype, - err = qh.qh_ops->scan_dquots(&qh, scan_dquots_callback, &scan_data); - if (err) { - log_debug("Error scanning dquots"); -+ *usage_inconsistent = 1; - goto out_close_qh; - } - -diff --git a/lib/support/quotaio_tree.c b/lib/support/quotaio_tree.c -index a7c2028..6cc4fb5 100644 ---- a/lib/support/quotaio_tree.c -+++ b/lib/support/quotaio_tree.c -@@ -540,6 +540,17 @@ struct dquot *qtree_read_dquot(struct quota_handle *h, qid_t id) - return dquot; - } - -+static int check_reference(struct quota_handle *h, unsigned int blk) -+{ -+ if (blk >= h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks) { -+ log_err("Illegal reference (%u >= %u) in %s quota file", -+ blk, h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks, -+ quota_type2name(h->qh_type)); -+ return -1; -+ } -+ return 0; -+} -+ - /* - * Scan all dquots in file and call callback on each - */ -@@ -558,7 +569,7 @@ static int report_block(struct dquot *dquot, unsigned int blk, char *bitmap, - int entries, i; - - if (!buf) -- return 0; -+ return -1; - - set_bit(bitmap, blk); - read_blk(dquot->dq_h, blk, buf); -@@ -580,23 +591,12 @@ static int report_block(struct dquot *dquot, unsigned int blk, char *bitmap, - return entries; - } - --static void check_reference(struct quota_handle *h, unsigned int blk) --{ -- if (blk >= h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks) -- log_err("Illegal reference (%u >= %u) in %s quota file. " -- "Quota file is probably corrupted.\n" -- "Please run e2fsck (8) to fix it.", -- blk, -- h->qh_info.u.v2_mdqi.dqi_qtree.dqi_blocks, -- quota_type2name(h->qh_type)); --} -- - static int report_tree(struct dquot *dquot, unsigned int blk, int depth, - char *bitmap, - int (*process_dquot) (struct dquot *, void *), - void *data) - { -- int entries = 0, i; -+ int entries = 0, ret, i; - dqbuf_t buf = getdqbuf(); - __le32 *ref = (__le32 *) buf; - -@@ -607,22 +607,40 @@ static int report_tree(struct dquot *dquot, unsigned int blk, int depth, - if (depth == QT_TREEDEPTH - 1) { - for (i = 0; i < QT_BLKSIZE >> 2; i++) { - blk = ext2fs_le32_to_cpu(ref[i]); -- check_reference(dquot->dq_h, blk); -- if (blk && !get_bit(bitmap, blk)) -- entries += report_block(dquot, blk, bitmap, -- process_dquot, data); -+ if (check_reference(dquot->dq_h, blk)) { -+ entries = -1; -+ goto errout; -+ } -+ if (blk && !get_bit(bitmap, blk)) { -+ ret = report_block(dquot, blk, bitmap, -+ process_dquot, data); -+ if (ret < 0) { -+ entries = ret; -+ goto errout; -+ } -+ entries += ret; -+ } - } - } else { - for (i = 0; i < QT_BLKSIZE >> 2; i++) { - blk = ext2fs_le32_to_cpu(ref[i]); - if (blk) { -- check_reference(dquot->dq_h, blk); -- entries += report_tree(dquot, blk, depth + 1, -- bitmap, process_dquot, -- data); -+ if (check_reference(dquot->dq_h, blk)) { -+ entries = -1; -+ goto errout; -+ } -+ ret = report_tree(dquot, blk, depth + 1, -+ bitmap, process_dquot, -+ data); -+ if (ret < 0) { -+ entries = ret; -+ goto errout; -+ } -+ entries += ret; - } - } - } -+errout: - freedqbuf(buf); - return entries; - } -@@ -642,6 +660,7 @@ int qtree_scan_dquots(struct quota_handle *h, - int (*process_dquot) (struct dquot *, void *), - void *data) - { -+ int ret; - char *bitmap; - struct v2_mem_dqinfo *v2info = &h->qh_info.u.v2_mdqi; - struct qtree_mem_dqinfo *info = &v2info->dqi_qtree; -@@ -655,10 +674,14 @@ int qtree_scan_dquots(struct quota_handle *h, - ext2fs_free_mem(&dquot); - return -1; - } -- v2info->dqi_used_entries = report_tree(dquot, QT_TREEOFF, 0, bitmap, -- process_dquot, data); -+ ret = report_tree(dquot, QT_TREEOFF, 0, bitmap, process_dquot, data); -+ if (ret < 0) -+ goto errout; -+ v2info->dqi_used_entries = ret; - v2info->dqi_data_blocks = find_set_bits(bitmap, info->dqi_blocks); -+ ret = 0; -+errout: - ext2fs_free_mem(&bitmap); - ext2fs_free_mem(&dquot); -- return 0; -+ return ret; - } -diff --git a/lib/support/quotaio_v2.c b/lib/support/quotaio_v2.c -index 38be2a3..7390667 100644 ---- a/lib/support/quotaio_v2.c -+++ b/lib/support/quotaio_v2.c -@@ -175,6 +175,8 @@ static int v2_check_file(struct quota_handle *h, int type, int fmt) - static int v2_init_io(struct quota_handle *h) - { - struct v2_disk_dqinfo ddqinfo; -+ struct v2_mem_dqinfo *info; -+ __u64 filesize; - - h->qh_info.u.v2_mdqi.dqi_qtree.dqi_entry_size = - sizeof(struct v2r1_disk_dqblk); -@@ -185,6 +187,32 @@ static int v2_init_io(struct quota_handle *h) - sizeof(ddqinfo)) != sizeof(ddqinfo)) - return -1; - v2_disk2memdqinfo(&h->qh_info, &ddqinfo); -+ -+ /* Check to make sure quota file info is sane */ -+ info = &h->qh_info.u.v2_mdqi; -+ if (ext2fs_file_get_lsize(h->qh_qf.e2_file, &filesize)) -+ return -1; -+ if ((filesize > (1U << 31)) || -+ (info->dqi_qtree.dqi_blocks > -+ (filesize + QT_BLKSIZE - 1) >> QT_BLKSIZE_BITS)) { -+ log_err("Quota inode %u corrupted: file size %llu; " -+ "dqi_blocks %u", h->qh_qf.ino, -+ filesize, info->dqi_qtree.dqi_blocks); -+ return -1; -+ } -+ if (info->dqi_qtree.dqi_free_blk >= info->dqi_qtree.dqi_blocks) { -+ log_err("Quota inode %u corrupted: free_blk %u; dqi_blocks %u", -+ h->qh_qf.ino, info->dqi_qtree.dqi_free_blk, -+ info->dqi_qtree.dqi_blocks); -+ return -1; -+ } -+ if (info->dqi_qtree.dqi_free_entry >= info->dqi_qtree.dqi_blocks) { -+ log_err("Quota inode %u corrupted: free_entry %u; " -+ "dqi_blocks %u", h->qh_qf.ino, -+ info->dqi_qtree.dqi_free_entry, -+ info->dqi_qtree.dqi_blocks); -+ return -1; -+ } - return 0; - } - --- -1.8.3.1 - diff --git a/9001-add-device-check-in-ismount-process.patch b/9001-add-device-check-in-ismount-process.patch new file mode 100644 index 0000000000000000000000000000000000000000..f033b0974650318c66cb4a3edb4b8fcfa112303d --- /dev/null +++ b/9001-add-device-check-in-ismount-process.patch @@ -0,0 +1,60 @@ +From 72e7f067a0d7671b372c23ee727b39b5b24f93da Mon Sep 17 00:00:00 2001 +From: guiyao +Date: Wed, 15 Apr 2020 20:13:26 +0000 +Subject: [PATCH] add device check in ismount process + +Signed-off-by: guiyao +Signed-off-by: Shijie Luo +--- + lib/ext2fs/ismounted.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/lib/ext2fs/ismounted.c b/lib/ext2fs/ismounted.c +index 46d330d..2add4c0 100644 +--- a/lib/ext2fs/ismounted.c ++++ b/lib/ext2fs/ismounted.c +@@ -98,6 +98,7 @@ static errcode_t check_mntent_file(const char *mtab_file, const char *file, + { + struct mntent *mnt; + struct stat st_buf; ++ struct stat dir_st_buf; + errcode_t retval = 0; + dev_t file_dev=0, file_rdev=0; + ino_t file_ino=0; +@@ -128,24 +129,27 @@ static errcode_t check_mntent_file(const char *mtab_file, const char *file, + while ((mnt = getmntent (f)) != NULL) { + if (mnt->mnt_fsname[0] != '/') + continue; +- if (stat(mnt->mnt_dir, &st_buf) != 0) ++ if (stat(mnt->mnt_dir, &dir_st_buf) != 0) + continue; + if (strcmp(file, mnt->mnt_fsname) == 0) { +- if (file_rdev && (file_rdev != st_buf.st_dev)) { ++ if (file_rdev && (file_rdev == dir_st_buf.st_dev)) { + #ifdef DEBUG + printf("Bogus entry in %s! " + "(%s does not exist)\n", + mtab_file, mnt->mnt_dir); + #endif /* DEBUG */ +- continue; ++ break; + } +- break; ++ continue; + } + if (stat(mnt->mnt_fsname, &st_buf) == 0) { + if (ext2fsP_is_disk_device(st_buf.st_mode)) { + #ifndef __GNU__ +- if (file_rdev && (file_rdev == st_buf.st_rdev)) +- break; ++ if (file_rdev && (file_rdev == st_buf.st_rdev)){ ++ if (file_rdev == dir_st_buf.st_dev) { ++ break; ++ } ++ } + if (check_loop_mounted(mnt->mnt_fsname, + st_buf.st_rdev, file_dev, + file_ino) == 1) +-- +1.8.3.1 + diff --git a/e2fsprogs-1.45.3.tar.xz b/e2fsprogs-1.45.6.tar.xz similarity index 47% rename from e2fsprogs-1.45.3.tar.xz rename to e2fsprogs-1.45.6.tar.xz index ac6a1b18092ccaf2f39c7572c76006b4ac04499f..a978a1d9460a3457dd7c0751023949750b6d9f6d 100644 Binary files a/e2fsprogs-1.45.3.tar.xz and b/e2fsprogs-1.45.6.tar.xz differ diff --git a/e2fsprogs.spec b/e2fsprogs.spec index 87f135cb8b9d1f1ea936c08f06b51a0044b66a16..eef3a3ad05fefcacb6b4cb0f8e40a8df5a2e8ce3 100644 --- a/e2fsprogs.spec +++ b/e2fsprogs.spec @@ -1,14 +1,13 @@ Name: e2fsprogs -Version: 1.45.3 -Release: 4 +Version: 1.45.6 +Release: 0 Summary: Second extended file system management tools License: GPLv2 and LGPLv2 and MIT URL: http://e2fsprogs.sourceforge.net/ Source0: https://www.kernel.org/pub/linux/kernel/people/tytso/%{name}/v%{version}/%{name}-%{version}.tar.xz -Patch6000: 6000-e2fsck-abort-if-there-is-a-corrupted-directory-block.patch -Patch6001: 6001-libsupport-add-checks-to-prevent-buffer-overrun-bugs.patch Patch9000: 9000-mke2fs-check.patch +Patch9001: 9001-add-device-check-in-ismount-process.patch BuildRequires: gcc git pkgconfig texinfo BuildRequires: fuse-devel libblkid-devel libuuid-devel @@ -90,7 +89,7 @@ fi exit 0 %files -f %{name}.lang -%doc README RELEASE-NOTES +%doc README %license NOTICE %config(noreplace) /etc/mke2fs.conf %config(noreplace) /etc/e2scrub.conf @@ -128,6 +127,26 @@ exit 0 %{_mandir}/man8/* %changelog +* Fri Apr 17 2020 luoshijie - 1.45.6-0 +- Type:enhancement +- ID:NA +- SUG:restart +- DESC:update package to 1.45.6. + +* Thu Mar 5 2020 luoshijie - 1.45.3-6 +- Type:bugfix +- ID:NA +- SUG:restart +- DESC:remove soft link RELEASE-NOTES from rpm, because this one + is no need to be packaged. + +* Fri Feb 28 2020 luoshijie - 1.45.3-5 +- Type:bugfix +- ID:NA +- SUG:restart +- DESC:sync bugfix patch from next. + add device check in ismount process. + * Mon Feb 3 2020 luoshijie - 1.45.3-4 - Type:cves - ID:CVE-2019-5094