mirror of
https://git.freebsd.org/ports.git
synced 2025-07-18 17:59:20 -04:00
Update to upstream release 1.42.13.
Changelog: <http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.42.13>
This commit is contained in:
parent
f0ff3d317c
commit
0c394defdf
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=404737
13 changed files with 46 additions and 545 deletions
|
@ -2,8 +2,8 @@
|
|||
# $FreeBSD$
|
||||
|
||||
PORTNAME= e2fsprogs
|
||||
PORTVERSION= 1.42.12
|
||||
PORTREVISION?= 2
|
||||
PORTVERSION= 1.42.13
|
||||
PORTREVISION?= 0
|
||||
CATEGORIES?= sysutils
|
||||
MASTER_SITES= KERNEL_ORG/linux/kernel/people/tytso/${PORTNAME}/v${PORTVERSION}
|
||||
|
||||
|
@ -74,8 +74,9 @@ post-patch::
|
|||
@${REINPLACE_CMD} -e 's/<malloc\.h>/<stdlib.h>/' ${WRKSRC}/*/*.c
|
||||
# disable f_mmp_garbage, fails on FreeBSD, and the resize*big_expand tests,
|
||||
# which are too unwieldy to run automatically (need too much free space).
|
||||
# f_extent_oobounds fails in Tinderbox and is fine outside, reason unclear.
|
||||
.for i in f_mmp_garbage m_bigjournal r_64bit_big_expand r_bigalloc_big_expand r_ext4_big_expand
|
||||
# f_extent_oobounds appears to have differences in screen output, reason
|
||||
# unclear.
|
||||
.for i in f_mmp_garbage m_bigjournal r_64bit_big_expand r_bigalloc_big_expand r_ext4_big_expand f_extent_oobounds
|
||||
@${MV} ${WRKSRC}/tests/${i} ${WRKSRC}/tests/disabled_test-${i}
|
||||
.endfor
|
||||
|
||||
|
|
|
@ -1,2 +1,2 @@
|
|||
SHA256 (e2fsprogs-1.42.12.tar.xz) = 6dadcd3b759195150d20154ab9d6516e3b3cbb35d66d461f55ae94a2854e7de8
|
||||
SIZE (e2fsprogs-1.42.12.tar.xz) = 4777592
|
||||
SHA256 (e2fsprogs-1.42.13.tar.xz) = e16474b5a3a30f9197160c4b91bd48d5a463583049c0fcc405b6f0f7075aa0c7
|
||||
SIZE (e2fsprogs-1.42.13.tar.xz) = 4802740
|
||||
|
|
|
@ -1,48 +0,0 @@
|
|||
From 160f131deed7d3db2aa958051eef7ae8fafa8539 Mon Sep 17 00:00:00 2001
|
||||
From: Eric Sandeen <sandeen@redhat.com>
|
||||
Date: Thu, 23 Oct 2014 16:27:32 -0500
|
||||
Subject: libext2fs: fix endian handling of ext3_extent_header
|
||||
|
||||
This turned up when trying to resize a filesystem containing
|
||||
a file with many extents on PPC64.
|
||||
|
||||
Fix all locations where ext3_extent_header members aren't
|
||||
handled in an endian-safe manner.
|
||||
|
||||
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
|
||||
|
||||
diff --git a/lib/ext2fs/ext3_extents.h b/lib/ext2fs/ext3_extents.h
|
||||
index 88fabc9..fcf4d86 100644
|
||||
--- ./lib/ext2fs/ext3_extents.h
|
||||
+++ ./lib/ext2fs/ext3_extents.h
|
||||
@@ -95,15 +95,20 @@ struct ext3_ext_path {
|
||||
((struct ext3_extent_idx *) (((char *) (__hdr__)) + \
|
||||
sizeof(struct ext3_extent_header)))
|
||||
#define EXT_HAS_FREE_INDEX(__path__) \
|
||||
- ((__path__)->p_hdr->eh_entries < (__path__)->p_hdr->eh_max)
|
||||
+ (ext2fs_le16_to_cpu((__path__)->p_hdr->eh_entries) < \
|
||||
+ ext2fs_le16_to_cpu((__path__)->p_hdr->eh_max))
|
||||
#define EXT_LAST_EXTENT(__hdr__) \
|
||||
- (EXT_FIRST_EXTENT((__hdr__)) + (__hdr__)->eh_entries - 1)
|
||||
+ (EXT_FIRST_EXTENT((__hdr__)) + \
|
||||
+ ext2fs_le16_to_cpu((__hdr__)->eh_entries) - 1)
|
||||
#define EXT_LAST_INDEX(__hdr__) \
|
||||
- (EXT_FIRST_INDEX((__hdr__)) + (__hdr__)->eh_entries - 1)
|
||||
+ (EXT_FIRST_INDEX((__hdr__)) + \
|
||||
+ ext2fs_le16_to_cpu((__hdr__)->eh_entries) - 1)
|
||||
#define EXT_MAX_EXTENT(__hdr__) \
|
||||
- (EXT_FIRST_EXTENT((__hdr__)) + (__hdr__)->eh_max - 1)
|
||||
+ (EXT_FIRST_EXTENT((__hdr__)) + \
|
||||
+ ext2fs_le16_to_cpu((__hdr__)->eh_max) - 1)
|
||||
#define EXT_MAX_INDEX(__hdr__) \
|
||||
- (EXT_FIRST_INDEX((__hdr__)) + (__hdr__)->eh_max - 1)
|
||||
+ (EXT_FIRST_INDEX((__hdr__)) + \
|
||||
+ ext2fs_le16_to_cpu((__hdr__)->eh_max) - 1)
|
||||
|
||||
#endif /* _LINUX_EXT3_EXTENTS */
|
||||
|
||||
--
|
||||
cgit v0.10.2
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
From 407916f5af4443e0ddd9469c57fc1684c07f9294 Mon Sep 17 00:00:00 2001
|
||||
From: "Darrick J. Wong" <darrick.wong@oracle.com>
|
||||
Date: Fri, 7 Nov 2014 21:27:53 -0500
|
||||
Subject: libext2fs: fix endian handling error; reduce fragmentation some
|
||||
|
||||
If we're going to read the "nr - 1" entry in an indirect block for use
|
||||
as a "goal" input to the block allocator, we need to byteswap the
|
||||
entry. While we're at it, if we're allocating blocks for the zeroth
|
||||
entry in the indirect block, we might as well use the indirect block
|
||||
as the starting point to try to reduce fragmentation.
|
||||
|
||||
(d_fallocate_blkmap will test this...)
|
||||
|
||||
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
|
||||
diff --git a/lib/ext2fs/bmap.c b/lib/ext2fs/bmap.c
|
||||
index db2fd72..a8bb00d 100644
|
||||
--- ./lib/ext2fs/bmap.c
|
||||
+++ ./lib/ext2fs/bmap.c
|
||||
@@ -67,7 +67,7 @@ static _BMAP_INLINE_ errcode_t block_ind_bmap(ext2_filsys fs, int flags,
|
||||
#endif
|
||||
|
||||
if (!b && (flags & BMAP_ALLOC)) {
|
||||
- b = nr ? ((blk_t *) block_buf)[nr-1] : 0;
|
||||
+ b = nr ? ext2fs_le32_to_cpu(((blk_t *)block_buf)[nr - 1]) : ind;
|
||||
retval = ext2fs_alloc_block(fs, b,
|
||||
block_buf + fs->blocksize, &b);
|
||||
if (retval)
|
||||
--
|
||||
cgit v0.10.2
|
||||
|
|
@ -1,128 +0,0 @@
|
|||
From 63b4cbb8bc8602d5dfe80413005142a7b59c25ef Mon Sep 17 00:00:00 2001
|
||||
From: "Darrick J. Wong" <darrick.wong@oracle.com>
|
||||
Date: Tue, 2 Dec 2014 22:00:04 -0500
|
||||
Subject: misc: fix infinite loop when finding the start of the hugefile start
|
||||
range
|
||||
|
||||
When looking for the start of the hugefile range, the 'next' variable
|
||||
is incorrectly decremented. If we happened to find a single free
|
||||
block, the effect of this decrement is that blk == next, which means
|
||||
that we never modify the loop control variable, so get_start_block
|
||||
never returns.
|
||||
|
||||
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
|
||||
diff --git a/misc/mk_hugefiles.c b/misc/mk_hugefiles.c
|
||||
index 8291f01..5f56a79 100644
|
||||
--- ./misc/mk_hugefiles.c
|
||||
+++ ./misc/mk_hugefiles.c
|
||||
@@ -437,7 +437,6 @@ static blk64_t get_start_block(ext2_filsys fs, blk64_t slack)
|
||||
blk, last_blk, &next);
|
||||
if (retval)
|
||||
next = last_blk;
|
||||
- next--;
|
||||
|
||||
if (next - blk > slack) {
|
||||
blk += slack;
|
||||
diff --git a/tests/m_hugefile_slack/expect b/tests/m_hugefile_slack/expect
|
||||
new file mode 100644
|
||||
index 0000000..96a628a
|
||||
--- /dev/null
|
||||
+++ ./tests/m_hugefile_slack/expect
|
||||
@@ -0,0 +1,18 @@
|
||||
+tune2fs test
|
||||
+Creating filesystem with 786432 1k blocks and 98304 inodes
|
||||
+Superblock backups stored on blocks:
|
||||
+ 8193, 24577, 40961, 57345, 73729, 204801, 221185, 401409, 663553
|
||||
+
|
||||
+Allocating group tables: done
|
||||
+Writing inode tables: done
|
||||
+Creating journal (16384 blocks): done
|
||||
+Creating 6368 huge file(s) with 117 blocks each: done
|
||||
+Writing superblocks and filesystem accounting information: done
|
||||
+
|
||||
+Pass 1: Checking inodes, blocks, and sizes
|
||||
+Pass 2: Checking directory structure
|
||||
+Pass 3: Checking directory connectivity
|
||||
+Pass 4: Checking reference counts
|
||||
+Pass 5: Checking group summary information
|
||||
+
|
||||
+Exit status is 0
|
||||
diff --git a/tests/m_hugefile_slack/name b/tests/m_hugefile_slack/name
|
||||
new file mode 100644
|
||||
index 0000000..8d51fd6
|
||||
--- /dev/null
|
||||
+++ ./tests/m_hugefile_slack/name
|
||||
@@ -0,0 +1 @@
|
||||
+mke2fs creating a hugefile fs with a lot of slack
|
||||
diff --git a/tests/m_hugefile_slack/script b/tests/m_hugefile_slack/script
|
||||
new file mode 100644
|
||||
index 0000000..eecb2d7
|
||||
--- /dev/null
|
||||
+++ ./tests/m_hugefile_slack/script
|
||||
@@ -0,0 +1,61 @@
|
||||
+if test -x $RESIZE2FS_EXE -a -x $DEBUGFS_EXE; then
|
||||
+
|
||||
+FSCK_OPT=-fn
|
||||
+OUT=$test_name.log
|
||||
+EXP=$test_dir/expect
|
||||
+CONF=$TMPFILE.conf
|
||||
+
|
||||
+#gzip -d < $EXP.gz > $EXP
|
||||
+
|
||||
+cat > $CONF << ENDL
|
||||
+[fs_types]
|
||||
+ ext4h = {
|
||||
+ features = has_journal,extent,huge_file,uninit_bg,dir_nlink,extra_isize,sparse_super,filetype,dir_index,ext_attr,^resize_inode,^meta_bg,^flex_bg,64bit
|
||||
+ blocksize = 1024
|
||||
+ inode_size = 256
|
||||
+ make_hugefiles = true
|
||||
+ hugefiles_dir = /
|
||||
+ hugefiles_slack = 12000K
|
||||
+ hugefiles_name = aaaaa
|
||||
+ hugefiles_digits = 4
|
||||
+ hugefiles_size = 117K
|
||||
+ zero_hugefiles = false
|
||||
+ }
|
||||
+ENDL
|
||||
+
|
||||
+echo "tune2fs test" > $OUT
|
||||
+
|
||||
+MKE2FS_CONFIG=$CONF $MKE2FS -F -T ext4h -I 128 $TMPFILE 786432 >> $OUT 2>&1
|
||||
+rm -rf $CONF
|
||||
+
|
||||
+# dump and check. if we get this far, we succeeded...
|
||||
+$FSCK $FSCK_OPT -N test_filesys $TMPFILE >> $OUT 2>&1
|
||||
+status=$?
|
||||
+echo Exit status is $status >> $OUT
|
||||
+
|
||||
+rm $TMPFILE
|
||||
+
|
||||
+#
|
||||
+# Do the verification
|
||||
+#
|
||||
+
|
||||
+sed -f $cmd_dir/filter.sed -e "s;$TMPFILE;test.img;" -e 's/test_filesys:.*//g' < $OUT > $OUT.new
|
||||
+mv $OUT.new $OUT
|
||||
+
|
||||
+cmp -s $OUT $EXP
|
||||
+status=$?
|
||||
+
|
||||
+if [ "$status" = 0 ] ; then
|
||||
+ echo "$test_name: $test_description: ok"
|
||||
+ touch $test_name.ok
|
||||
+else
|
||||
+ echo "$test_name: $test_description: failed"
|
||||
+ diff $DIFF_OPTS $EXP $OUT > $test_name.failed
|
||||
+fi
|
||||
+
|
||||
+unset IMAGE FSCK_OPT OUT EXP CONF
|
||||
+
|
||||
+else #if test -x $RESIZE2FS_EXE -a -x $DEBUGFS_EXE; then
|
||||
+ echo "$test_name: $test_description: skipped"
|
||||
+fi
|
||||
+
|
||||
--
|
||||
cgit v0.10.2
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
From 49d0fe2a14f2a23da2fe299643379b8c1d37df73 Mon Sep 17 00:00:00 2001
|
||||
From: Theodore Ts'o <tytso@mit.edu>
|
||||
Date: Fri, 6 Feb 2015 12:46:39 -0500
|
||||
Subject: libext2fs: fix potential buffer overflow in closefs()
|
||||
|
||||
The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if
|
||||
s_first_meta_bg is too big" had a typo in the fix for
|
||||
ext2fs_closefs(). In practice most of the security exposure was from
|
||||
the openfs path, since this meant if there was a carefully crafted
|
||||
file system, buffer overrun would be triggered when the file system was
|
||||
opened.
|
||||
|
||||
However, if corrupted file system didn't trip over some corruption
|
||||
check, and then the file system was modified via tune2fs or debugfs,
|
||||
such that the superblock was marked dirty and then written out via the
|
||||
closefs() path, it's possible that the buffer overrun could be
|
||||
triggered when the file system is closed.
|
||||
|
||||
Also clear up a signed vs unsigned warning while we're at it.
|
||||
|
||||
Thanks to Nick Kralevich <nnk@google.com> for asking me to look at
|
||||
compiler warning in the code in question, which led me to notice the
|
||||
bug in f66e6ce4446.
|
||||
|
||||
Addresses: CVE-2015-1572
|
||||
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
|
||||
diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c
|
||||
index 1f99113..ab5b2fb 100644
|
||||
--- ./lib/ext2fs/closefs.c
|
||||
+++ ./lib/ext2fs/closefs.c
|
||||
@@ -287,7 +287,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
|
||||
dgrp_t j;
|
||||
#endif
|
||||
char *group_ptr;
|
||||
- int old_desc_blocks;
|
||||
+ blk64_t old_desc_blocks;
|
||||
struct ext2fs_numeric_progress_struct progress;
|
||||
|
||||
EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
|
||||
@@ -346,7 +346,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
|
||||
group_ptr = (char *) group_shadow;
|
||||
if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) {
|
||||
old_desc_blocks = fs->super->s_first_meta_bg;
|
||||
- if (old_desc_blocks > fs->super->s_first_meta_bg)
|
||||
+ if (old_desc_blocks > fs->desc_blocks)
|
||||
old_desc_blocks = fs->desc_blocks;
|
||||
} else
|
||||
old_desc_blocks = fs->desc_blocks;
|
||||
--
|
||||
cgit v0.10.2
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
From beec19ff21d41c84dbbc2ab8d0df25147912ff59 Mon Sep 17 00:00:00 2001
|
||||
From: "Darrick J. Wong" <darrick.wong@oracle.com>
|
||||
Date: Wed, 5 Nov 2014 11:14:26 -0500
|
||||
Subject: e2fsck: fix dangling pointer when dir_info array is resized
|
||||
|
||||
e2fsck uses an array to store directory usage information during pass
|
||||
3; the usage context also contains a pointer to the last directory
|
||||
looked up. When expanding the dir_info array, this cache pointer
|
||||
needs to be cleared if the array resize changed the pointer location,
|
||||
or else we'll later walk off the end of this dead pointer.
|
||||
|
||||
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
|
||||
Reported-by: Sami Liedes <sami.liedes@iki.fi>
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
|
||||
diff --git a/e2fsck/dirinfo.c b/e2fsck/dirinfo.c
|
||||
index 4a9019b..dab5a13 100644
|
||||
--- ./e2fsck/dirinfo.c
|
||||
+++ ./e2fsck/dirinfo.c
|
||||
@@ -121,7 +121,7 @@ static void setup_db(e2fsck_t ctx)
|
||||
void e2fsck_add_dir_info(e2fsck_t ctx, ext2_ino_t ino, ext2_ino_t parent)
|
||||
{
|
||||
struct dir_info_db *db;
|
||||
- struct dir_info *dir, ent;
|
||||
+ struct dir_info *dir, ent, *old_array;
|
||||
int i, j;
|
||||
errcode_t retval;
|
||||
unsigned long old_size;
|
||||
@@ -136,6 +136,7 @@ void e2fsck_add_dir_info(e2fsck_t ctx, ext2_ino_t ino, ext2_ino_t parent)
|
||||
if (ctx->dir_info->count >= ctx->dir_info->size) {
|
||||
old_size = ctx->dir_info->size * sizeof(struct dir_info);
|
||||
ctx->dir_info->size += 10;
|
||||
+ old_array = ctx->dir_info->array;
|
||||
retval = ext2fs_resize_mem(old_size, ctx->dir_info->size *
|
||||
sizeof(struct dir_info),
|
||||
&ctx->dir_info->array);
|
||||
@@ -147,6 +148,8 @@ void e2fsck_add_dir_info(e2fsck_t ctx, ext2_ino_t ino, ext2_ino_t parent)
|
||||
ctx->dir_info->size -= 10;
|
||||
return;
|
||||
}
|
||||
+ if (old_array != ctx->dir_info->array)
|
||||
+ ctx->dir_info->last_lookup = NULL;
|
||||
}
|
||||
|
||||
ent.ino = ino;
|
||||
--
|
||||
cgit v0.10.2
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
From dab7435917698bb490cce61fc8be1be0a862cf66 Mon Sep 17 00:00:00 2001
|
||||
From: "Darrick J. Wong" <darrick.wong@oracle.com>
|
||||
Date: Sat, 25 Oct 2014 13:56:42 -0700
|
||||
Subject: libext2fs: directory iteration mustn't walk off the buffer end
|
||||
|
||||
When we're iterating a directory, the loop control code reads the
|
||||
length of the next directory record, failing to account for the fact
|
||||
that there must be at least 8 bytes (the minimum size of a directory
|
||||
entry) left in the buffer to read the next directory record. Fix the
|
||||
loop conditional so that we don't read off the end of the buffer.
|
||||
|
||||
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
|
||||
Reported-by: Sami Liedes <sami.liedes@iki.fi>
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
|
||||
diff --git a/lib/ext2fs/dir_iterate.c b/lib/ext2fs/dir_iterate.c
|
||||
index 589af69..0744ee8 100644
|
||||
--- ./lib/ext2fs/dir_iterate.c
|
||||
+++ ./lib/ext2fs/dir_iterate.c
|
||||
@@ -202,7 +202,7 @@ int ext2fs_process_dir_block(ext2_filsys fs,
|
||||
if (ctx->errcode)
|
||||
return BLOCK_ABORT;
|
||||
|
||||
- while (offset < fs->blocksize) {
|
||||
+ while (offset < fs->blocksize - 8) {
|
||||
dirent = (struct ext2_dir_entry *) (ctx->buf + offset);
|
||||
if (ext2fs_get_rec_len(fs, dirent, &rec_len))
|
||||
return BLOCK_ABORT;
|
||||
--
|
||||
cgit v0.10.2
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
From e9a5c6e3607d17641543aa5e801af22563fb1410 Mon Sep 17 00:00:00 2001
|
||||
From: Theodore Ts'o <tytso@mit.edu>
|
||||
Date: Thu, 11 Sep 2014 12:24:07 -0400
|
||||
Subject: e2fsck: notice when the realloc of dir_info fails
|
||||
|
||||
If the reallocation of dir_info fails, we will eventually cause e2fsck
|
||||
to fail with an internal error. So if the realloc fails, print a
|
||||
message and bail out with a fatal error early when at the time of the
|
||||
reallocation failure.
|
||||
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
|
||||
diff --git a/e2fsck/dirinfo.c b/e2fsck/dirinfo.c
|
||||
index dbaf471..4a9019b 100644
|
||||
--- ./e2fsck/dirinfo.c
|
||||
+++ ./e2fsck/dirinfo.c
|
||||
@@ -140,6 +140,10 @@ void e2fsck_add_dir_info(e2fsck_t ctx, ext2_ino_t ino, ext2_ino_t parent)
|
||||
sizeof(struct dir_info),
|
||||
&ctx->dir_info->array);
|
||||
if (retval) {
|
||||
+ fprintf(stderr, "Couldn't reallocate dir_info "
|
||||
+ "structure to %d entries\n",
|
||||
+ ctx->dir_info->size);
|
||||
+ fatal_error(ctx, 0);
|
||||
ctx->dir_info->size -= 10;
|
||||
return;
|
||||
}
|
||||
diff --git a/e2fsck/dx_dirinfo.c b/e2fsck/dx_dirinfo.c
|
||||
index 7838a40..be53fff 100644
|
||||
--- ./e2fsck/dx_dirinfo.c
|
||||
+++ ./e2fsck/dx_dirinfo.c
|
||||
@@ -40,6 +40,10 @@ void e2fsck_add_dx_dir(e2fsck_t ctx, ext2_ino_t ino, int num_blocks)
|
||||
sizeof(struct dx_dir_info),
|
||||
&ctx->dx_dir_info);
|
||||
if (retval) {
|
||||
+ fprintf(stderr, "Couldn't reallocate dx_dir_info "
|
||||
+ "structure to %d entries\n",
|
||||
+ ctx->dx_dir_info_size);
|
||||
+ fatal_error(ctx, 0);
|
||||
ctx->dx_dir_info_size -= 10;
|
||||
return;
|
||||
}
|
||||
--
|
||||
cgit v0.10.2
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
commit f38676c3e4001359b96576204e9024557ef5fd1b
|
||||
Author: Theodore Ts'o <tytso@mit.edu>
|
||||
Date: Wed Oct 8 11:47:00 2014 -0400
|
||||
|
||||
e2fsprogs: 1.42.11 regression in memory handling: use-after-free since commit 47fee2e "e2fsprogs: introduce ext2fs_close_free() helper"
|
||||
|
||||
Hi Matthias,
|
||||
|
||||
Thanks for reporting this. I'm not 100% sure this will fix your
|
||||
problem, since your specific valgrind failures aren't reproducing for
|
||||
me. That being said, I was able to find a valgrind failure, and after
|
||||
looking closely at the commit that you bisected things to, I found a
|
||||
bug which was introduced by commit 47fee2ef6a23a.
|
||||
|
||||
Could you check and see if this fixes the problems you are seeing?
|
||||
|
||||
Many thanks!!
|
||||
|
||||
- Ted
|
||||
|
||||
commit ebdf895b43a1ce499e4d2556a201e2a753fc422f
|
||||
Author: Theodore Ts'o <tytso@mit.edu>
|
||||
Date: Wed Oct 8 11:18:41 2014 -0400
|
||||
|
||||
e2fsck: fix free pointer dereferences
|
||||
|
||||
Commit 47fee2ef6a23a introduces some free pointer dereference bugs by
|
||||
not clearing ctx->fs after calling ext2fs_close_free().
|
||||
|
||||
Reported-by: Matthias Andree <mandree@FreeBSD.org>
|
||||
Cc: Lukas Czerner <lczerner@redhat.com>
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
|
||||
diff --git a/e2fsck/unix.c b/e2fsck/unix.c
|
||||
index 66debcd..10036e7 100644
|
||||
--- ./e2fsck/unix.c
|
||||
+++ ./e2fsck/unix.c
|
||||
@@ -458,7 +458,7 @@ static void check_if_skip(e2fsck_t ctx)
|
||||
}
|
||||
log_out(ctx, "\n");
|
||||
skip:
|
||||
- ext2fs_close_free(&fs);
|
||||
+ ext2fs_close_free(&ctx->fs);
|
||||
e2fsck_free_context(ctx);
|
||||
exit(FSCK_OK);
|
||||
}
|
||||
@@ -1462,7 +1462,7 @@ failure:
|
||||
/*
|
||||
* Restart in order to reopen fs but this time start mmp.
|
||||
*/
|
||||
- ext2fs_close_free(&fs);
|
||||
+ ext2fs_close_free(&ctx->fs);
|
||||
flags &= ~EXT2_FLAG_SKIP_MMP;
|
||||
goto restart;
|
||||
}
|
||||
@@ -1692,7 +1692,7 @@ no_journal:
|
||||
_("while resetting context"));
|
||||
fatal_error(ctx, 0);
|
||||
}
|
||||
- ext2fs_close_free(&fs);
|
||||
+ ext2fs_close_free(&ctx->fs);
|
||||
goto restart;
|
||||
}
|
||||
if (run_result & E2F_FLAG_ABORT)
|
38
sysutils/e2fsprogs/files/patch-zzz-f449486d
Normal file
38
sysutils/e2fsprogs/files/patch-zzz-f449486d
Normal file
|
@ -0,0 +1,38 @@
|
|||
From f449486d631987983b4275d246b7bbbb551f3235 Mon Sep 17 00:00:00 2001
|
||||
From: Andreas Dilger <adilger@dilger.ca>
|
||||
Date: Mon, 30 Nov 2015 12:09:44 -0500
|
||||
Subject: libext2fs: fix tst_badblocks buffer overrun
|
||||
|
||||
The test2[] array is not 0-terminated and the create_test_list() for
|
||||
loop does not terminate properly at the end of this array, but
|
||||
continues until it hits the 0 at the end of test3[].
|
||||
|
||||
Reported-by: Hanno Boeck <hanno@hboeck.de>
|
||||
Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=104311
|
||||
Signed-off-by: Andreas Dilger <adilger@dilger.ca>
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
---
|
||||
lib/ext2fs/tst_badblocks.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/ext2fs/tst_badblocks.c b/lib/ext2fs/tst_badblocks.c
|
||||
index 3b39ef1..c685f33 100644
|
||||
--- ./lib/ext2fs/tst_badblocks.c
|
||||
+++ ./lib/ext2fs/tst_badblocks.c
|
||||
@@ -30,11 +30,11 @@
|
||||
#define DEL_BLK 0x0002
|
||||
|
||||
blk_t test1[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 0 };
|
||||
-blk_t test2[] = { 11, 10, 9, 8, 7, 6, 5, 4, 3, 3, 2, 1 };
|
||||
+blk_t test2[] = { 11, 10, 9, 8, 7, 6, 5, 4, 3, 3, 2, 1, 0 };
|
||||
blk_t test3[] = { 3, 1, 4, 5, 9, 2, 7, 10, 5, 6, 10, 8, 0 };
|
||||
blk_t test4[] = { 20, 50, 12, 17, 13, 2, 66, 23, 56, 0 };
|
||||
blk_t test4a[] = {
|
||||
- 20, 1,
|
||||
+ 20, 1,
|
||||
50, 1,
|
||||
3, 0,
|
||||
17, 1,
|
||||
--
|
||||
cgit v0.11.2
|
||||
|
|
@ -1,90 +0,0 @@
|
|||
commit f8d3d1661885a07ac9ef639dda0ce23d181a2c73
|
||||
Author: Theodore Ts'o <tytso@mit.edu>
|
||||
Date: Wed Oct 8 12:18:32 2014 -0400
|
||||
|
||||
resize2fs: fix fs->blocksize dereference after fs has been freed]
|
||||
|
||||
FYI, you'll probably want this patch too, since it's applicable to 1.42.12.
|
||||
|
||||
- Ted
|
||||
|
||||
Commit 77255cf36944b introduced a use after free bug.
|
||||
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
|
||||
diff --git a/resize/main.c b/resize/main.c
|
||||
index c107028..983d8c2 100644
|
||||
--- ./resize/main.c
|
||||
+++ ./resize/main.c
|
||||
@@ -181,6 +181,7 @@ int main (int argc, char ** argv)
|
||||
ext2fs_struct_stat st_buf;
|
||||
__s64 new_file_size;
|
||||
unsigned int sys_page_size = 4096;
|
||||
+ unsigned int blocksize;
|
||||
long sysval;
|
||||
int len, mount_flags;
|
||||
char *mtpt;
|
||||
@@ -366,7 +367,8 @@ int main (int argc, char ** argv)
|
||||
* defaults and for making sure the new filesystem doesn't
|
||||
* exceed the partition size.
|
||||
*/
|
||||
- retval = ext2fs_get_device_size2(device_name, fs->blocksize,
|
||||
+ blocksize = fs->blocksize;
|
||||
+ retval = ext2fs_get_device_size2(device_name, blocksize,
|
||||
&max_size);
|
||||
if (retval) {
|
||||
com_err(program_name, retval, "%s",
|
||||
@@ -386,8 +388,8 @@ int main (int argc, char ** argv)
|
||||
} else {
|
||||
new_size = max_size;
|
||||
/* Round down to an even multiple of a pagesize */
|
||||
- if (sys_page_size > fs->blocksize)
|
||||
- new_size &= ~((sys_page_size / fs->blocksize)-1);
|
||||
+ if (sys_page_size > blocksize)
|
||||
+ new_size &= ~((sys_page_size / blocksize)-1);
|
||||
}
|
||||
if (!EXT2_HAS_INCOMPAT_FEATURE(fs->super,
|
||||
EXT4_FEATURE_INCOMPAT_64BIT)) {
|
||||
@@ -423,7 +425,7 @@ int main (int argc, char ** argv)
|
||||
* automatically extend it in a sparse fashion by writing the
|
||||
* last requested block.
|
||||
*/
|
||||
- new_file_size = ((__u64) new_size) * fs->blocksize;
|
||||
+ new_file_size = ((__u64) new_size) * blocksize;
|
||||
if ((__u64) new_file_size >
|
||||
(((__u64) 1) << (sizeof(st_buf.st_size)*8 - 1)) - 1)
|
||||
fd = -1;
|
||||
@@ -437,13 +439,13 @@ int main (int argc, char ** argv)
|
||||
fprintf(stderr, _("The containing partition (or device)"
|
||||
" is only %llu (%dk) blocks.\nYou requested a new size"
|
||||
" of %llu blocks.\n\n"), max_size,
|
||||
- fs->blocksize / 1024, new_size);
|
||||
+ blocksize / 1024, new_size);
|
||||
exit(1);
|
||||
}
|
||||
if (new_size == ext2fs_blocks_count(fs->super)) {
|
||||
fprintf(stderr, _("The filesystem is already %llu (%dk) "
|
||||
"blocks long. Nothing to do!\n\n"), new_size,
|
||||
- fs->blocksize / 1024);
|
||||
+ blocksize / 1024);
|
||||
exit(0);
|
||||
}
|
||||
if (mount_flags & EXT2_MF_MOUNTED) {
|
||||
@@ -453,7 +455,7 @@ int main (int argc, char ** argv)
|
||||
bigalloc_check(fs, force);
|
||||
printf(_("Resizing the filesystem on "
|
||||
"%s to %llu (%dk) blocks.\n"),
|
||||
- device_name, new_size, fs->blocksize / 1024);
|
||||
+ device_name, new_size, blocksize / 1024);
|
||||
retval = resize_fs(fs, &new_size, flags,
|
||||
((flags & RESIZE_PERCENT_COMPLETE) ?
|
||||
resize_progress_func : 0));
|
||||
@@ -470,7 +472,7 @@ int main (int argc, char ** argv)
|
||||
exit(1);
|
||||
}
|
||||
printf(_("The filesystem on %s is now %llu (%dk) blocks long.\n\n"),
|
||||
- device_name, new_size, fs->blocksize / 1024);
|
||||
+ device_name, new_size, blocksize / 1024);
|
||||
|
||||
if ((st_buf.st_size > new_file_size) &&
|
||||
(fd > 0)) {
|
|
@ -58,6 +58,7 @@ sbin/resize2fs
|
|||
sbin/tune2fs
|
||||
%%NLS%%share/locale/ca/LC_MESSAGES/e2fsprogs.mo
|
||||
%%NLS%%share/locale/cs/LC_MESSAGES/e2fsprogs.mo
|
||||
%%NLS%%share/locale/da/LC_MESSAGES/e2fsprogs.mo
|
||||
%%NLS%%share/locale/de/LC_MESSAGES/e2fsprogs.mo
|
||||
%%NLS%%share/locale/eo/LC_MESSAGES/e2fsprogs.mo
|
||||
%%NLS%%share/locale/es/LC_MESSAGES/e2fsprogs.mo
|
||||
|
|
Loading…
Add table
Reference in a new issue