rpms/e2fsprogs
7
0
Fork 1
Code Issues Pull Requests Releases Activity

import e2fsprogs-1.45.6-5.el8

Browse Source
This commit is contained in:
CentOS Sources 2022-11-08 01:56:31 -05:00 committed by Stepan Oksanichenko
parent fc13d7e1cf
commit 43994a69a7
49 changed files with 2995 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

100
SOURCES/e2fsprogs-1.45.6-Add-checks-for-fs-blocksize-0-which-could-cause-some.patch Normal file
View File

@ -0,0 +1,100 @@
From 0111635ea5798f98665714e161c3c7746184a04b Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Tue, 23 Feb 2021 16:02:42 -0500
Subject: [PATCH 21/46] Add checks for fs->blocksize == 0 which could cause
some crashes
Content-Type: text/plain
This should never happeb, but some checks is useful, and also fixes
some Coverity warnings.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
debugfs/do_journal.c | 2 --
lib/ext2fs/csum.c | 3 +++
lib/ext2fs/ext2_err.et.in | 3 +++
lib/ext2fs/inode.c | 4 ++++
misc/e2image.c | 5 +++--
5 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/debugfs/do_journal.c b/debugfs/do_journal.c
index 5091a530..8261fa95 100644
--- a/debugfs/do_journal.c
+++ b/debugfs/do_journal.c
@@ -528,8 +528,6 @@ static errcode_t journal_write(journal_t *journal,
}
err = journal_close_trans(&trans);
- if (err)
- goto error;
error:
return err;
}
diff --git a/lib/ext2fs/csum.c b/lib/ext2fs/csum.c
index 2151003b..28b3bb05 100644
--- a/lib/ext2fs/csum.c
+++ b/lib/ext2fs/csum.c
@@ -263,6 +263,9 @@ static errcode_t __get_dirent_tail(ext2_filsys fs,
errcode_t retval = 0;
__u16 (*translate)(__u16) = (need_swab ? disk_to_host16 : do_nothing16);
+ if (fs->blocksize < 1024)
+ return EXT2_FILSYS_CORRUPTED; /* Should never happen */
+
d = dirent;
top = EXT2_DIRENT_TAIL(dirent, fs->blocksize);
diff --git a/lib/ext2fs/ext2_err.et.in b/lib/ext2fs/ext2_err.et.in
index 0c76fee6..cf0e00ea 100644
--- a/lib/ext2fs/ext2_err.et.in
+++ b/lib/ext2fs/ext2_err.et.in
@@ -548,4 +548,7 @@ ec EXT2_ET_EA_INODE_CORRUPTED,
ec EXT2_ET_NO_GDESC,
"Group descriptors not loaded"
+ec EXT2_FILSYS_CORRUPTED,
+ "The internal ext2_filsys data structure appears to be corrupted"
+
end
diff --git a/lib/ext2fs/inode.c b/lib/ext2fs/inode.c
index c4377eeb..6f42882e 100644
--- a/lib/ext2fs/inode.c
+++ b/lib/ext2fs/inode.c
@@ -144,6 +144,8 @@ errcode_t ext2fs_open_inode_scan(ext2_filsys fs, int buffer_blocks,
errcode_t (*save_get_blocks)(ext2_filsys f, ext2_ino_t ino, blk_t *blocks);
EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
+ if (fs->blocksize < 1024)
+ return EXT2_FILSYS_CORRUPTED; /* Should never happen */
/*
* If fs->badblocks isn't set, then set it --- since the inode
@@ -764,6 +766,8 @@ errcode_t ext2fs_read_inode2(ext2_filsys fs, ext2_ino_t ino,
int cache_slot, fail_csum;
EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS);
+ if (fs->blocksize < 1024)
+ return EXT2_FILSYS_CORRUPTED; /* Should never happen */
/* Check to see if user has an override function */
if (fs->read_inode &&
diff --git a/misc/e2image.c b/misc/e2image.c
index 892c5371..195fabb2 100644
--- a/misc/e2image.c
+++ b/misc/e2image.c
@@ -892,8 +892,9 @@ static errcode_t initialize_qcow2_image(int fd, ext2_filsys fs,
int cluster_bits = get_bits_from_size(fs->blocksize);
struct ext2_super_block *sb = fs->super;
- if (fs->blocksize < 1024)
- return EINVAL; /* Can never happen, but just in case... */
+ /* Sbould never happen, but just in case... */
+ if (cluster_bits < 0)
+ return EXT2_FILSYS_CORRUPTED;
/* Allocate header */
ret = ext2fs_get_memzero(sizeof(struct ext2_qcow2_hdr), &header);
--
2.35.1

104
SOURCES/e2fsprogs-1.45.6-Fix-clang-warnings.patch Normal file
View File

@ -0,0 +1,104 @@
From 1466a142efe5b20ddda2ce96c0d409dc294fd1b2 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Sat, 23 Jan 2021 00:57:18 -0500
Subject: [PATCH 17/46] Fix clang warnings
Content-Type: text/plain
Clang gets unhappy when passing an unsigned char to string functions.
For better or for worse we use __u8[] in the definition of the
superblock. So cast them these to "char *" to prevent clang
build-time warnings.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
e2fsck/unix.c | 2 +-
lib/ext2fs/mmp.c | 8 ++++----
misc/e2fuzz.c | 3 ++-
misc/mke2fs.c | 4 ++--
4 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/e2fsck/unix.c b/e2fsck/unix.c
index e71d7833..15a73e7c 100644
--- a/e2fsck/unix.c
+++ b/e2fsck/unix.c
@@ -1693,7 +1693,7 @@ failure:
* or informational messages to the user.
*/
if (ctx->device_name == 0 && sb->s_volume_name[0])
- ctx->device_name = string_copy(ctx, sb->s_volume_name,
+ ctx->device_name = string_copy(ctx, (char *) sb->s_volume_name,
sizeof(sb->s_volume_name));
if (ctx->device_name == 0)
diff --git a/lib/ext2fs/mmp.c b/lib/ext2fs/mmp.c
index e96a2273..973b9ecd 100644
--- a/lib/ext2fs/mmp.c
+++ b/lib/ext2fs/mmp.c
@@ -210,11 +210,11 @@ static errcode_t ext2fs_mmp_reset(ext2_filsys fs)
mmp_s->mmp_seq = EXT4_MMP_SEQ_CLEAN;
mmp_s->mmp_time = 0;
#ifdef HAVE_GETHOSTNAME
- gethostname(mmp_s->mmp_nodename, sizeof(mmp_s->mmp_nodename));
+ gethostname((char *) mmp_s->mmp_nodename, sizeof(mmp_s->mmp_nodename));
#else
mmp_s->mmp_nodename[0] = '\0';
#endif
- strncpy(mmp_s->mmp_bdevname, fs->device_name,
+ strncpy((char *) mmp_s->mmp_bdevname, fs->device_name,
sizeof(mmp_s->mmp_bdevname));
mmp_s->mmp_check_interval = fs->super->s_mmp_update_interval;
@@ -352,11 +352,11 @@ clean_seq:
mmp_s->mmp_seq = seq = ext2fs_mmp_new_seq();
#ifdef HAVE_GETHOSTNAME
- gethostname(mmp_s->mmp_nodename, sizeof(mmp_s->mmp_nodename));
+ gethostname((char *) mmp_s->mmp_nodename, sizeof(mmp_s->mmp_nodename));
#else
strcpy(mmp_s->mmp_nodename, "unknown host");
#endif
- strncpy(mmp_s->mmp_bdevname, fs->device_name,
+ strncpy((char *) mmp_s->mmp_bdevname, fs->device_name,
sizeof(mmp_s->mmp_bdevname));
retval = ext2fs_mmp_write(fs, fs->super->s_mmp_block, fs->mmp_buf);
diff --git a/misc/e2fuzz.c b/misc/e2fuzz.c
index 7c0f776f..65b6ae73 100644
--- a/misc/e2fuzz.c
+++ b/misc/e2fuzz.c
@@ -172,7 +172,8 @@ static uint64_t rand_num(uint64_t min, uint64_t max)
for (i = 0; i < sizeof(x); i++)
px[i] = random();
- return min + (uint64_t)((double)(max - min) * (x / (UINT64_MAX + 1.0)));
+ return min + (uint64_t)((double)(max - min) *
+ (x / ((double) UINT64_MAX + 1.0)));
}
static int process_fs(const char *fsname)
diff --git a/misc/mke2fs.c b/misc/mke2fs.c
index 27e7d174..0184a3a8 100644
--- a/misc/mke2fs.c
+++ b/misc/mke2fs.c
@@ -3151,7 +3151,7 @@ int main (int argc, char *argv[])
if (volume_label) {
memset(fs->super->s_volume_name, 0,
sizeof(fs->super->s_volume_name));
- strncpy(fs->super->s_volume_name, volume_label,
+ strncpy((char *) fs->super->s_volume_name, volume_label,
sizeof(fs->super->s_volume_name));
}
@@ -3161,7 +3161,7 @@ int main (int argc, char *argv[])
if (mount_dir) {
memset(fs->super->s_last_mounted, 0,
sizeof(fs->super->s_last_mounted));
- strncpy(fs->super->s_last_mounted, mount_dir,
+ strncpy((char *) fs->super->s_last_mounted, mount_dir,
sizeof(fs->super->s_last_mounted));
}
--
2.35.1

48
SOURCES/e2fsprogs-1.45.6-append_pathname-check-the-value-returned-by-realloc.patch Normal file
View File

@ -0,0 +1,48 @@
From c74301ce5020c499445eb5c32bd70e4a1099a62d Mon Sep 17 00:00:00 2001
From: wuguanghao <wuguanghao3@huawei.com>
Date: Wed, 30 Jun 2021 16:27:18 +0800
Subject: [PATCH 29/46] append_pathname: check the value returned by realloc
Content-Type: text/plain
In append_pathname(), we need to add a new path to save the value
returned by realloc, otherwise the name->path may be NULL, causing
a segfault.
Signed-off-by: Wu Guanghao <wuguanghao3@huawei.com>
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
contrib/fsstress.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/contrib/fsstress.c b/contrib/fsstress.c
index 2a983482..2136a903 100644
--- a/contrib/fsstress.c
+++ b/contrib/fsstress.c
@@ -599,6 +599,7 @@ void add_to_flist(int ft, int id, int parent)
void append_pathname(pathname_t * name, char *str)
{
int len;
+ char *path;
len = strlen(str);
#ifdef DEBUG
@@ -609,7 +610,13 @@ void append_pathname(pathname_t * name, char *str)
}
#endif
- name->path = realloc(name->path, name->len + 1 + len);
+ path = realloc(name->path, name->len + 1 + len);
+ if (path == NULL) {
+ fprintf(stderr, "fsstress: append_pathname realloc failed\n");
+ chdir(homedir);
+ abort();
+ }
+ name->path = path;
strcpy(&name->path[name->len], str);
name->len += len;
}
--
2.35.1

34
SOURCES/e2fsprogs-1.45.6-argv_parse-check-return-value-of-malloc-in-argv_pars.patch Normal file
View File

@ -0,0 +1,34 @@
From 9e298ba470a6abc7d94fe659cf65fcb0b993c0b8 Mon Sep 17 00:00:00 2001
From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Date: Wed, 30 Jun 2021 16:27:19 +0800
Subject: [PATCH 30/46] argv_parse: check return value of malloc in
argv_parse()
Content-Type: text/plain
In argv_parse(), return value of malloc should be checked
whether it is NULL, otherwise, it may cause a segfault error.
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: Wu Guanghao <wuguanghao3@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/support/argv_parse.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/lib/support/argv_parse.c b/lib/support/argv_parse.c
index d22f6344..1f50f9e5 100644
--- a/lib/support/argv_parse.c
+++ b/lib/support/argv_parse.c
@@ -116,6 +116,8 @@ int argv_parse(char *in_buf, int *ret_argc, char ***ret_argv)
if (argv == 0) {
argv = malloc(sizeof(char *));
free(buf);
+ if (!argv)
+ return -1;
}
argv[argc] = 0;
if (ret_argc)
--
2.35.1

47
SOURCES/e2fsprogs-1.45.6-create_inode-set-xattrs-to-the-root-directory-as-wel.patch Normal file
View File

@ -0,0 +1,47 @@
From ade5263a516e4081abc14f63a73a5e0a96bb3f71 Mon Sep 17 00:00:00 2001
From: Antoine Tenart <antoine.tenart@bootlin.com>
Date: Fri, 17 Jul 2020 12:08:46 +0200
Subject: [PATCH 13/46] create_inode: set xattrs to the root directory as well
Content-Type: text/plain
populate_fs do copy the xattrs for all files and directories, but the
root directory is skipped and as a result its extended attributes aren't
set. This is an issue when using mkfs to build a full system image that
can be used with SElinux in enforcing mode without making any runtime
fix at first boot.
This patch adds logic to set the root directory's extended attributes.
Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
misc/create_inode.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/misc/create_inode.c b/misc/create_inode.c
index 837f3875..6f8487b9 100644
--- a/misc/create_inode.c
+++ b/misc/create_inode.c
@@ -1050,9 +1050,17 @@ errcode_t populate_fs2(ext2_filsys fs, ext2_ino_t parent_ino,
file_info.path_max_len = 255;
file_info.path = calloc(file_info.path_max_len, 1);
+ retval = set_inode_xattr(fs, root, source_dir);
+ if (retval) {
+ com_err(__func__, retval,
+ _("while copying xattrs on root directory"));
+ goto out;
+ }
+
retval = __populate_fs(fs, parent_ino, source_dir, root, &hdlinks,
&file_info, fs_callbacks);
+out:
free(file_info.path);
free(hdlinks.hdl);
return retval;
--
2.35.1

35
SOURCES/e2fsprogs-1.45.6-debugfs-fix-double-free-in-realloc-error-path-in-rea.patch Normal file
View File

@ -0,0 +1,35 @@
From 4126c63885388e568ade780e9fed6ede37faf978 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Thu, 21 Jan 2021 16:01:14 -0500
Subject: [PATCH 16/46] debugfs: fix double free in realloc() error path in
read_list()
Content-Type: text/plain
Fixes-Coverity-Bug: 1464575
Fixes-Coverity-Bug: 1464571
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
debugfs/util.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/debugfs/util.c b/debugfs/util.c
index 759bb392..091f6f65 100644
--- a/debugfs/util.c
+++ b/debugfs/util.c
@@ -545,10 +545,8 @@ errcode_t read_list(char *str, blk64_t **list, size_t *len)
goto err;
}
l = realloc(lst, sizeof(blk64_t) * (ln + y - x + 1));
- if (l == NULL) {
- retval = ENOMEM;
- goto err;
- }
+ if (l == NULL)
+ return ENOMEM;
lst = l;
for (; x <= y; x++)
lst[ln++] = x;
--
2.35.1

92
SOURCES/e2fsprogs-1.45.6-debugfs-fix-memory-allocation-failures-when-parsing-.patch Normal file
View File

@ -0,0 +1,92 @@
From b31f493cadc92023056a096d0281957c49fca22c Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Fri, 12 Feb 2021 21:43:00 -0500
Subject: [PATCH 19/46] debugfs: fix memory allocation failures when parsing
journal_write arguments
Content-Type: text/plain
Fix double-free issues when parsing an invalid journal_write command,
such as: "journal_write -b 12 -b BAD -b 42".
Addresses-Coverity-Bug: 1464571
Addresses-Coverity-Bug: 1464575
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
debugfs/do_journal.c | 8 ++++++--
debugfs/util.c | 15 +++++++--------
2 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/debugfs/do_journal.c b/debugfs/do_journal.c
index 15ef6829..5091a530 100644
--- a/debugfs/do_journal.c
+++ b/debugfs/do_journal.c
@@ -554,15 +554,19 @@ void do_journal_write(int argc, char *argv[], int sci_idx EXT2FS_ATTR((unused)),
switch (opt) {
case 'b':
err = read_list(optarg, &blist, &bn);
- if (err)
+ if (err) {
com_err(argv[0], err,
"while reading block list");
+ goto out;
+ }
break;
case 'r':
err = read_list(optarg, &rlist, &rn);
- if (err)
+ if (err) {
com_err(argv[0], err,
"while reading revoke list");
+ goto out;
+ }
break;
case 'c':
flags |= JOURNAL_WRITE_NO_COMMIT;
diff --git a/debugfs/util.c b/debugfs/util.c
index 091f6f65..bbb20ff6 100644
--- a/debugfs/util.c
+++ b/debugfs/util.c
@@ -521,7 +521,7 @@ errcode_t read_list(char *str, blk64_t **list, size_t *len)
blk64_t *lst = *list;
size_t ln = *len;
char *tok, *p = str;
- errcode_t retval;
+ errcode_t retval = 0;
while ((tok = strtok(p, ","))) {
blk64_t *l;
@@ -538,15 +538,17 @@ errcode_t read_list(char *str, blk64_t **list, size_t *len)
return errno;
} else if (*e != 0) {
retval = EINVAL;
- goto err;
+ break;
}
if (y < x) {
retval = EINVAL;
- goto err;
+ break;
}
l = realloc(lst, sizeof(blk64_t) * (ln + y - x + 1));
- if (l == NULL)
- return ENOMEM;
+ if (l == NULL) {
+ retval = ENOMEM;
+ break;
+ }
lst = l;
for (; x <= y; x++)
lst[ln++] = x;
@@ -555,8 +557,5 @@ errcode_t read_list(char *str, blk64_t **list, size_t *len)
*list = lst;
*len = ln;
- return 0;
-err:
- free(lst);
return retval;
}
--
2.35.1

46
SOURCES/e2fsprogs-1.45.6-debugfs-fix-memory-leak-problem-in-read_list.patch Normal file
View File

@ -0,0 +1,46 @@
From 9221fb77a7187957ed84e45bf6ad6f5e37755e5c Mon Sep 17 00:00:00 2001
From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Date: Sat, 20 Feb 2021 16:41:29 +0800
Subject: [PATCH 22/46] debugfs: fix memory leak problem in read_list()
Content-Type: text/plain
In read_list func, if strtoull() fails in while loop,
we will return the error code directly. Then, memory of
variable lst will be leaked without setting to *list.
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: linfeilong <linfeilong@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
debugfs/util.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/debugfs/util.c b/debugfs/util.c
index bbb20ff6..37620295 100644
--- a/debugfs/util.c
+++ b/debugfs/util.c
@@ -530,12 +530,16 @@ errcode_t read_list(char *str, blk64_t **list, size_t *len)
errno = 0;
y = x = strtoull(tok, &e, 0);
- if (errno)
- return errno;
+ if (errno) {
+ retval = errno;
+ break;
+ }
if (*e == '-') {
y = strtoull(e + 1, NULL, 0);
- if (errno)
- return errno;
+ if (errno) {
+ retval = errno;
+ break;
+ }
} else if (*e != 0) {
retval = EINVAL;
break;
--
2.35.1

54
SOURCES/e2fsprogs-1.45.6-debugfs-fix-parse_uint-for-64-bit-fields.patch Normal file
View File

@ -0,0 +1,54 @@
From c78e3e170a63bb1804b47d4f5a6652aad0e4d3b2 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Tue, 6 Oct 2020 08:29:09 -0400
Subject: [PATCH 12/46] debugfs: fix parse_uint for 64-bit fields
Content-Type: text/plain
The logic for handling 64-bit structure elements was reversed, which
caused attempts to set fields like kbytes_written to fail:
% debugfs -w /tmp/foo.img
debugfs 1.45.6 (20-Mar-2020)
debugfs: set_super_value kbytes_written 1024
64-bit field kbytes_written has a second 64-bit field
defined; BUG?!?
https://github.com/tytso/e2fsprogs/issues/36
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
debugfs/set_fields.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/debugfs/set_fields.c b/debugfs/set_fields.c
index 5142554d..281f2c5d 100644
--- a/debugfs/set_fields.c
+++ b/debugfs/set_fields.c
@@ -487,10 +487,7 @@ static errcode_t parse_uint(struct field_set_info *info, char *field,
n = num & mask;
switch (size) {
case 8:
- /* Should never get here */
- fprintf(stderr, "64-bit field %s has a second 64-bit field\n"
- "defined; BUG?!?\n", info->name);
- *u.ptr64 = 0;
+ *u.ptr64 = n;
break;
case 4:
*u.ptr32 = n;
@@ -510,7 +507,10 @@ static errcode_t parse_uint(struct field_set_info *info, char *field,
size = 2;
switch (size) {
case 8:
- *u.ptr64 = n;
+ /* Should never get here */
+ fprintf(stderr, "64-bit field %s has a second 64-bit field\n"
+ "defined; BUG?!?\n", info->name);
+ *u.ptr64 = 0;
break;
case 4:
*u.ptr32 = n;
--
2.35.1

42
SOURCES/e2fsprogs-1.45.6-e2fsck-add-maximum-string-length-specifiers-to-fscan.patch Normal file
View File

@ -0,0 +1,42 @@
From c9d064c7a4e4ffbfaf95098c57381ee5394a1346 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Tue, 10 Aug 2021 15:36:46 -0400
Subject: [PATCH 45/46] e2fsck: add maximum string length specifiers to fscanf
format strings
Content-Type: text/plain
When parsing strings from /proc/apm and /proc/acpi/ac_adapter, add
string length limits to prevent possible buffer overruns.
Addresses-Coverty-Bug: 1297496
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
e2fsck/unix.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/e2fsck/unix.c b/e2fsck/unix.c
index 15a73e7c..ddd384b1 100644
--- a/e2fsck/unix.c
+++ b/e2fsck/unix.c
@@ -302,7 +302,7 @@ static int is_on_batt(void)
}
f = fopen("/proc/apm", "r");
if (f) {
- if (fscanf(f, "%s %s %s %x", tmp, tmp, tmp, &acflag) != 4)
+ if (fscanf(f, "%79s %79s %79s %x", tmp, tmp, tmp, &acflag) != 4)
acflag = 1;
fclose(f);
return (acflag != 1);
@@ -318,7 +318,7 @@ static int is_on_batt(void)
f = fopen(fname, "r");
if (!f)
continue;
- if (fscanf(f, "%s %s", tmp2, tmp) != 2)
+ if (fscanf(f, "%79s %79s", tmp2, tmp) != 2)
tmp[0] = 0;
fclose(f);
if (strncmp(tmp, "off-line", 8) == 0) {
--
2.35.1

43
SOURCES/e2fsprogs-1.45.6-e2fsck-fix-indexed-dir-rehash-failure-with-metadata_.patch Normal file
View File

@ -0,0 +1,43 @@
From 5ddac7d248ad346b80702a397c886df4d1ec4f08 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Thu, 13 Feb 2020 11:15:57 +0100
Subject: [PATCH 05/46] e2fsck: fix indexed dir rehash failure with
metadata_csum enabled
Content-Type: text/plain
E2fsck directory rehashing code can fail with ENOSPC due to a bug in
ext2fs_htree_intnode_maxrecs() which fails to take metadata checksum
into account and thus e.g. e2fsck can decide to create 1 indirect level
of index tree when two are actually needed. Fix the logic to account for
metadata checksum.
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/ext2fs.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/lib/ext2fs/ext2fs.h b/lib/ext2fs/ext2fs.h
index 32c75171..d9aec525 100644
--- a/lib/ext2fs/ext2fs.h
+++ b/lib/ext2fs/ext2fs.h
@@ -2040,7 +2040,13 @@ _INLINE_ blk_t ext2fs_inode_data_blocks(ext2_filsys fs,
_INLINE_ int ext2fs_htree_intnode_maxrecs(ext2_filsys fs, int blocks)
{
- return blocks * ((fs->blocksize - 8) / sizeof(struct ext2_dx_entry));
+ int csum_size = 0;
+
+ if ((EXT2_SB(fs->super)->s_feature_ro_compat &
+ EXT4_FEATURE_RO_COMPAT_METADATA_CSUM) != 0)
+ csum_size = sizeof(struct ext2_dx_tail);
+ return blocks * ((fs->blocksize - (8 + csum_size)) /
+ sizeof(struct ext2_dx_entry));
}
/*
--
2.35.1

64
SOURCES/e2fsprogs-1.45.6-e2fsck-fix-last-mount-write-time-when-e2fsck-is-forc.patch Normal file
View File

@ -0,0 +1,64 @@
From b93c62c3d46ed363a88668d41a87500eb5d29f98 Mon Sep 17 00:00:00 2001
From: Lukas Czerner <lczerner@redhat.com>
Date: Mon, 14 Jun 2021 15:27:25 +0200
Subject: [PATCH 26/46] e2fsck: fix last mount/write time when e2fsck is forced
Content-Type: text/plain
With commit c52d930f e2fsck is no longer able to fix bad last
mount/write time by default because it is conditioned on s_checkinterval
not being zero, which it is by default.
One place where it matters is when other e2fsprogs tools require to run
full file system check before a certain operation. If the last mount
time is for any reason in future, it will not allow it to run even if
full e2fsck is ran.
Fix it by checking the last mount/write time when the e2fsck is forced,
except for the case where we know the system clock is broken.
[ Reworked the conditionals so error messages claiming that the last
write/mount time were corrupted wouldn't be always printed when the
e2fsck was run with the -f option, thus causing 299 out of 372
regression tests to fail. -- TYT ]
Fixes: c52d930f ("e2fsck: don't check for future superblock times if checkinterval == 0")
Reported-by: Dusty Mabe <dustymabe@redhat.com>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
e2fsck/super.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/e2fsck/super.c b/e2fsck/super.c
index e1c3f935..31e2ffb2 100644
--- a/e2fsck/super.c
+++ b/e2fsck/super.c
@@ -1038,9 +1038,9 @@ void check_super_block(e2fsck_t ctx)
* Check to see if the superblock last mount time or last
* write time is in the future.
*/
- if (!broken_system_clock && fs->super->s_checkinterval &&
- !(ctx->flags & E2F_FLAG_TIME_INSANE) &&
- fs->super->s_mtime > (__u32) ctx->now) {
+ if (((ctx->options & E2F_OPT_FORCE) || fs->super->s_checkinterval) &&
+ !broken_system_clock && !(ctx->flags & E2F_FLAG_TIME_INSANE) &&
+ (fs->super->s_mtime > (__u32) ctx->now)) {
pctx.num = fs->super->s_mtime;
problem = PR_0_FUTURE_SB_LAST_MOUNT;
if (fs->super->s_mtime <= (__u32) ctx->now + ctx->time_fudge)
@@ -1050,9 +1050,9 @@ void check_super_block(e2fsck_t ctx)
fs->flags |= EXT2_FLAG_DIRTY;
}
}
- if (!broken_system_clock && fs->super->s_checkinterval &&
- !(ctx->flags & E2F_FLAG_TIME_INSANE) &&
- fs->super->s_wtime > (__u32) ctx->now) {
+ if (((ctx->options & E2F_OPT_FORCE) || fs->super->s_checkinterval) &&
+ !broken_system_clock && !(ctx->flags & E2F_FLAG_TIME_INSANE) &&
+ (fs->super->s_wtime > (__u32) ctx->now)) {
pctx.num = fs->super->s_wtime;
problem = PR_0_FUTURE_SB_LAST_WRITE;
if (fs->super->s_wtime <= (__u32) ctx->now + ctx->time_fudge)
--
2.35.1

31
SOURCES/e2fsprogs-1.45.6-e2fsck-fix-off-by-one-check-when-validating-depth-of.patch Normal file
View File

@ -0,0 +1,31 @@
From 669a17d35cdfd9cf5b76e97016fae2df2d72e768 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Fri, 10 Apr 2020 00:30:52 -0400
Subject: [PATCH 07/46] e2fsck: fix off-by-one check when validating depth of
an htree
Content-Type: text/plain
Fixes: 3f0cf6475399 ("e2fsprogs: add support for 3-level htree")
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
e2fsck/pass1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/e2fsck/pass1.c b/e2fsck/pass1.c
index c9e8bf82..38afda48 100644
--- a/e2fsck/pass1.c
+++ b/e2fsck/pass1.c
@@ -2685,7 +2685,7 @@ static int handle_htree(e2fsck_t ctx, struct problem_context *pctx,
return 1;
pctx->num = root->indirect_levels;
- if ((root->indirect_levels > ext2_dir_htree_level(fs)) &&
+ if ((root->indirect_levels >= ext2_dir_htree_level(fs)) &&
fix_problem(ctx, PR_1_HTREE_DEPTH, pctx))
return 1;
--
2.35.1

47
SOURCES/e2fsprogs-1.45.6-e2fsck-use-size_t-instead-of-int-in-string_copy.patch Normal file
View File

@ -0,0 +1,47 @@
From 8a97e4f67f75a4584f7562b7e5d866431c88152e Mon Sep 17 00:00:00 2001
From: Lukas Czerner <lczerner@redhat.com>
Date: Fri, 5 Jun 2020 10:14:40 +0200
Subject: [PATCH 09/46] e2fsck: use size_t instead of int in string_copy()
Content-Type: text/plain
len argument in string_copy() is int, but it is used with malloc(),
strlen(), strncpy() and some callers use sizeof() to pass value in. So
it really ought to be size_t rather than int. Fix it.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
e2fsck/e2fsck.h | 2 +-
e2fsck/util.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/e2fsck/e2fsck.h b/e2fsck/e2fsck.h
index feb605c7..7e0895c2 100644
--- a/e2fsck/e2fsck.h
+++ b/e2fsck/e2fsck.h
@@ -608,7 +608,7 @@ extern void log_err(e2fsck_t ctx, const char *fmt, ...)
extern void e2fsck_read_bitmaps(e2fsck_t ctx);
extern void e2fsck_write_bitmaps(e2fsck_t ctx);
extern void preenhalt(e2fsck_t ctx);
-extern char *string_copy(e2fsck_t ctx, const char *str, int len);
+extern char *string_copy(e2fsck_t ctx, const char *str, size_t len);
extern int fs_proc_check(const char *fs_name);
extern int check_for_modules(const char *fs_name);
#ifdef RESOURCE_TRACK
diff --git a/e2fsck/util.c b/e2fsck/util.c
index d98b8e47..88e0ea8a 100644
--- a/e2fsck/util.c
+++ b/e2fsck/util.c
@@ -135,7 +135,7 @@ void *e2fsck_allocate_memory(e2fsck_t ctx, unsigned long size,
}
char *string_copy(e2fsck_t ctx EXT2FS_ATTR((unused)),
- const char *str, int len)
+ const char *str, size_t len)
{
char *ret;
--
2.35.1

38
SOURCES/e2fsprogs-1.45.6-e2image-fix-overflow-in-l2-table-processing.patch Normal file
View File

@ -0,0 +1,38 @@
From 1a97380b1cc4d167697e31e5fb663e805629c1ab Mon Sep 17 00:00:00 2001
From: Artem Blagodarenko <artem.blagodarenko@gmail.com>
Date: Thu, 22 Apr 2021 01:24:48 -0400
Subject: [PATCH 25/46] e2image: fix overflow in l2 table processing
Content-Type: text/plain
For a large partition during e2image capture process
it is possible to overflow offset at multiply operation.
This leads to the situation when data is written to the
position at the start of the image instead of the image end.
Let's use the right cast to avoid integer overflow.
Signed-off-by: Alexey Lyashkov <c17817@cray.com>
Signed-off-by: Artem Blagodarenko <c17828@cray.com>
HPE-bug-id: LUS-9368
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/qcow2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/ext2fs/qcow2.c b/lib/ext2fs/qcow2.c
index ee701f7a..20824170 100644
--- a/lib/ext2fs/qcow2.c
+++ b/lib/ext2fs/qcow2.c
@@ -238,7 +238,7 @@ int qcow2_write_raw_image(int qcow2_fd, int raw_fd,
if (offset == 0)
continue;
- off_out = (l1_index * img.l2_size) +
+ off_out = ((__u64)l1_index * img.l2_size) +
l2_index;
off_out <<= img.cluster_bits;
ret = qcow2_copy_data(qcow2_fd, raw_fd, offset,
--
2.35.1

34
SOURCES/e2fsprogs-1.45.6-ext2ed-fix-potential-NULL-pointer-dereference-in-dup.patch Normal file
View File

@ -0,0 +1,34 @@
From c0a66f76f9c5b2ed0c2f20d1b59b4715f10a60f7 Mon Sep 17 00:00:00 2001
From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Date: Wed, 30 Jun 2021 16:27:24 +0800
Subject: [PATCH 33/46] ext2ed: fix potential NULL pointer dereference in
dupstr()
Content-Type: text/plain
In dupstr(), we should check return value of malloc().
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: Wu Guanghao <wuguanghao3@huawei.com>
Reviewed-by: Wu Bo <wubo40@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
ext2ed/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/ext2ed/main.c b/ext2ed/main.c
index f7e7d7df..9d33a8e1 100644
--- a/ext2ed/main.c
+++ b/ext2ed/main.c
@@ -524,6 +524,8 @@ char *dupstr (char *src)
char *ptr;
ptr=(char *) malloc (strlen (src)+1);
+ if (!ptr)
+ return NULL;
strcpy (ptr,src);
return (ptr);
}
--
2.35.1

54
SOURCES/e2fsprogs-1.45.6-filefrag-handle-invalid-st_dev-and-blksize-cases.patch Normal file
View File

@ -0,0 +1,54 @@
From 381bc5d98b2a8a65b1f559e31e67361a761aefee Mon Sep 17 00:00:00 2001
From: Luis Henriques <lhenriques@suse.de>
Date: Wed, 28 Oct 2020 15:55:50 +0000
Subject: [PATCH 14/46] filefrag: handle invalid st_dev and blksize cases
Content-Type: text/plain
It is possible to crash filefrag with a "Floating point exception" in
two different scenarios:
1. When fstat() returns a device ID set to 0
2. When FIGETBSZ ioctl returns a blocksize of 0
In both scenarios a divide-by-zero will occur in frag_report() because
variable blksize will be set to zero.
I've managed to trigger this crash with an old CephFS kernel client,
using xfstest generic/519. The first scenario has been fixed by kernel
commit 75c9627efb72 ("ceph: map snapid to anonymous bdev ID"). The
second scenario is also fixed with commit 8f97d1e99149 ("vfs: fix
FIGETBSZ ioctl on an overlayfs file").
However, it is desirable to handle these two scenarios gracefully by
checking these conditions explicitly.
Signed-off-by: Luis Henriques <lhenriques@suse.de>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
misc/filefrag.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/misc/filefrag.c b/misc/filefrag.c
index 032535f3..a5b9bfe9 100644
--- a/misc/filefrag.c
+++ b/misc/filefrag.c
@@ -418,13 +418,13 @@ static int frag_report(const char *filename)
goto out_close;
}
- if (last_device != st.st_dev) {
+ if ((last_device != st.st_dev) || !st.st_dev) {
if (fstatfs(fd, &fsinfo) < 0) {
rc = -errno;
perror("fstatfs");
goto out_close;
}
- if (ioctl(fd, FIGETBSZ, &blksize) < 0)
+ if ((ioctl(fd, FIGETBSZ, &blksize) < 0) || !blksize)
blksize = fsinfo.f_bsize;
if (verbose)
printf("Filesystem type is: %lx\n",
--
2.35.1

33
SOURCES/e2fsprogs-1.45.6-lib-ss-error.c-check-return-value-malloc-in-ss_name.patch Normal file
View File

@ -0,0 +1,33 @@
From 693c06539f0c168c6edf32d25b4c64835a1e3f31 Mon Sep 17 00:00:00 2001
From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Date: Wed, 30 Jun 2021 16:27:21 +0800
Subject: [PATCH 32/46] lib/ss/error.c: check return value malloc in ss_name()
Content-Type: text/plain
In ss_name(), we should check return value of malloc(),
otherwise, it may cause a segmentation fault problem.
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Signed-off-by: Wu Guanghao <wuguanghao3@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ss/error.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/lib/ss/error.c b/lib/ss/error.c
index 8d345a9f..656b71be 100644
--- a/lib/ss/error.c
+++ b/lib/ss/error.c
@@ -42,6 +42,8 @@ char *ss_name(int sci_idx)
(strlen(infop->subsystem_name)+
strlen(infop->current_request)+
4));
+ if (ret_val == (char *)NULL)
+ return ((char *)NULL);
cp = ret_val;
cp1 = infop->subsystem_name;
while (*cp1)
--
2.35.1

56
SOURCES/e2fsprogs-1.45.6-libext2fs-add-sanity-check-to-extent-manipulation.patch Normal file
View File

@ -0,0 +1,56 @@
From 265fcf9204fd06f574578ebe780f24e62bac2e86 Mon Sep 17 00:00:00 2001
From: Lukas Czerner <lczerner@redhat.com>
Date: Thu, 21 Apr 2022 19:31:48 +0200
Subject: [PATCH 1/2] libext2fs: add sanity check to extent manipulation
Content-Type: text/plain
It is possible to have a corrupted extent tree in such a way that a leaf
node contains zero extents in it. Currently if that happens and we try
to traverse the tree we can end up accessing wrong data, or possibly
even uninitialized memory. Make sure we don't do that.
Additionally make sure that we have a sane number of bytes passed to
memmove() in ext2fs_extent_delete().
Note that e2fsck is currently unable to spot and fix such corruption in
pass1.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reported-by: Nils Bars <nils_bars@t-online.de>
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=2068113
Addresses: CVE-2022-1304
Addresses-Debian-Bug: #1010263
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
lib/ext2fs/extent.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/lib/ext2fs/extent.c b/lib/ext2fs/extent.c
index ac3dbfec..a1b1905c 100644
--- a/lib/ext2fs/extent.c
+++ b/lib/ext2fs/extent.c
@@ -495,6 +495,10 @@ retry:
ext2fs_le16_to_cpu(eh->eh_entries);
newpath->max_entries = ext2fs_le16_to_cpu(eh->eh_max);
+ /* Make sure there is at least one extent present */
+ if (newpath->left <= 0)
+ return EXT2_ET_EXTENT_NO_DOWN;
+
if (path->left > 0) {
ix++;
newpath->end_blk = ext2fs_le32_to_cpu(ix->ei_block);
@@ -1630,6 +1634,10 @@ errcode_t ext2fs_extent_delete(ext2_extent_handle_t handle, int flags)
cp = path->curr;
+ /* Sanity check before memmove() */
+ if (path->left < 0)
+ return EXT2_ET_EXTENT_LEAF_BAD;
+
if (path->left) {
memmove(cp, cp + sizeof(struct ext3_extent_idx),
path->left * sizeof(struct ext3_extent_idx));
--
2.35.1

58
SOURCES/e2fsprogs-1.45.6-libext2fs-don-t-needlessly-byte-swap-the-group-descr.patch Normal file
View File

@ -0,0 +1,58 @@
From 1aecdcc5c805e5e2114dd14877e9e1771fb519bf Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Thu, 16 Jan 2020 19:17:26 -0500
Subject: [PATCH 04/46] libext2fs: don't needlessly byte swap the group
descriptors in ext2fs_flush
Content-Type: text/plain
If the EXT2_FLAG_SUPER_ONLY is set, there's no reason to allocate the
shadow block group descriptors and byte swap the group descriptors.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/closefs.c | 24 ++++++++++++++----------
1 file changed, 14 insertions(+), 10 deletions(-)
diff --git a/lib/ext2fs/closefs.c b/lib/ext2fs/closefs.c
index 6814cdc3..69cbdd8c 100644
--- a/lib/ext2fs/closefs.c
+++ b/lib/ext2fs/closefs.c
@@ -331,20 +331,24 @@ errcode_t ext2fs_flush2(ext2_filsys fs, int flags)
#ifdef WORDS_BIGENDIAN
retval = EXT2_ET_NO_MEMORY;
retval = ext2fs_get_mem(SUPERBLOCK_SIZE, &super_shadow);
- if (retval)
- goto errout;
- retval = ext2fs_get_array(fs->desc_blocks, fs->blocksize,
- &group_shadow);
if (retval)
goto errout;
memcpy(super_shadow, fs->super, sizeof(struct ext2_super_block));
- memcpy(group_shadow, fs->group_desc, (size_t) fs->blocksize *
- fs->desc_blocks);
-
ext2fs_swap_super(super_shadow);
- for (j = 0; j < fs->group_desc_count; j++) {
- gdp = ext2fs_group_desc(fs, group_shadow, j);
- ext2fs_swap_group_desc2(fs, gdp);
+
+ if (((fs->flags & EXT2_FLAG_SUPER_ONLY) == 0) &&
+ !ext2fs_has_feature_journal_dev(fs->super)) {
+ retval = ext2fs_get_array(fs->desc_blocks, fs->blocksize,
+ &group_shadow);
+ if (retval)
+ goto errout;
+ memcpy(group_shadow, fs->group_desc, (size_t) fs->blocksize *
+ fs->desc_blocks);
+
+ for (j = 0; j < fs->group_desc_count; j++) {
+ gdp = ext2fs_group_desc(fs, group_shadow, j);
+ ext2fs_swap_group_desc2(fs, gdp);
+ }
}
#else
super_shadow = fs->super;
--
2.35.1

69
SOURCES/e2fsprogs-1.45.6-libext2fs-fix-crash-in-ext2fs_image_super_write-on-B.patch Normal file
View File

@ -0,0 +1,69 @@
From 20a8dbefbc0510430aa7744692221b843b657f62 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Tue, 14 Jan 2020 10:58:10 -0500
Subject: [PATCH 02/46] libext2fs: fix crash in ext2fs_image_super_write() on
Big Endian systems
Content-Type: text/plain
This is a similar fix as c9a8c53b17cc ("libext2fs: fix crash in
ext2fs_open2() on Big Endian systems").
Commit e6069a05: ("Teach ext2fs_open2() to honor the
EXT2_FLAG_SUPER_ONLY flag") changed how the function
ext2fs_group_desc() handled a request for a gdp pointer for a group
larger than the number of groups in the file system; it now returns
NULL, instead of returning a pointer beyond the end of the array.
Previously, the ext2fs_imager_super_write() function would swap all of
the block group descriptors in a block, even if they are beyond the
end of the file system. This was OK, since we were not overrunning
the allocated memory, since it was rounded to a block boundary. But
now that ext2fs_group_desc() would return NULL for those gdp, it would
cause ext2fs_open2(), when it was byte swapping the block group
descriptors on Big Endian systems, to dereference a null pointer and
crash.
This commit adds a NULL pointer check to avoid byte swapping those
block group descriptors in a bg descriptor block, but which are beyond
the end of the file system, to address this crash.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/imager.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/lib/ext2fs/imager.c b/lib/ext2fs/imager.c
index b3ede9a8..f8d67d86 100644
--- a/lib/ext2fs/imager.c
+++ b/lib/ext2fs/imager.c
@@ -249,10 +249,10 @@ errcode_t ext2fs_image_super_write(ext2_filsys fs, int fd,
* if needed
*/
groups_per_block = EXT2_DESC_PER_BLOCK(fs->super);
- gdp = (struct ext2_group_desc *) cp;
for (j=0; j < groups_per_block*fs->desc_blocks; j++) {
gdp = ext2fs_group_desc(fs, fs->group_desc, j);
- ext2fs_swap_group_desc2(fs, gdp);
+ if (gdp)
+ ext2fs_swap_group_desc2(fs, gdp);
}
#endif
@@ -261,10 +261,10 @@ errcode_t ext2fs_image_super_write(ext2_filsys fs, int fd,
#ifdef WORDS_BIGENDIAN
groups_per_block = EXT2_DESC_PER_BLOCK(fs->super);
- gdp = (struct ext2_group_desc *) cp;
for (j=0; j < groups_per_block*fs->desc_blocks; j++) {
gdp = ext2fs_group_desc(fs, fs->group_desc, j);
- ext2fs_swap_group_desc2(fs, gdp);
+ if (gdp)
+ ext2fs_swap_group_desc2(fs, gdp);
}
#endif
--
2.35.1

59
SOURCES/e2fsprogs-1.45.6-libext2fs-fix-crash-in-ext2fs_open2-on-Big-Endian-sy.patch Normal file
View File

@ -0,0 +1,59 @@
From db2efc9e0a8cdb70afc8dd7c9621da9376da7afb Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Thu, 26 Dec 2019 23:19:54 -0500
Subject: [PATCH 01/46] libext2fs: fix crash in ext2fs_open2() on Big Endian
systems
Content-Type: text/plain
Commit e6069a05: ("Teach ext2fs_open2() to honor the
EXT2_FLAG_SUPER_ONLY flag") changed how the function
ext2fs_group_desc() handled a request for a gdp pointer for a group
larger than the number of groups in the file system; it now returns
NULL, instead of returning a pointer beyond the end of the array.
Previously, the ext2fs_open2() function would swap all of the block
group descriptors in a block, even if they are beyond the end of the
file system. This was OK, since we were not overrunning the allocated
memory, since it was rounded to a block boundary. But now that
ext2fs_group_desc() would return NULL for those gdp, it would cause
ext2fs_open2(), when it was byte swapping the block group descriptors
on Big Endian systems, to dereference a null pointer and crash.
This commit adds a NULL pointer check to avoid byte swapping those
block group descriptors in a bg descriptor block, but which are beyond
the end of the file system, to address this crash.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reported-by: Anatoly Pugachev <matorola@gmail.com>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/openfs.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/lib/ext2fs/openfs.c b/lib/ext2fs/openfs.c
index 51b54a44..e457ce1a 100644
--- a/lib/ext2fs/openfs.c
+++ b/lib/ext2fs/openfs.c
@@ -433,7 +433,8 @@ errcode_t ext2fs_open2(const char *name, const char *io_options,
gdp = (struct ext2_group_desc *) dest;
for (j=0; j < groups_per_block*first_meta_bg; j++) {
gdp = ext2fs_group_desc(fs, fs->group_desc, j);
- ext2fs_swap_group_desc2(fs, gdp);
+ if (gdp)
+ ext2fs_swap_group_desc2(fs, gdp);
}
#endif
dest += fs->blocksize*first_meta_bg;
@@ -453,7 +454,8 @@ errcode_t ext2fs_open2(const char *name, const char *io_options,
for (j=0; j < groups_per_block; j++) {
gdp = ext2fs_group_desc(fs, fs->group_desc,
i * groups_per_block + j);
- ext2fs_swap_group_desc2(fs, gdp);
+ if (gdp)
+ ext2fs_swap_group_desc2(fs, gdp);
}
#endif
dest += fs->blocksize;
--
2.35.1

36
SOURCES/e2fsprogs-1.45.6-libext2fs-fix-crash-when-ext2fs_mmp_stop-is-called-b.patch Normal file
View File

@ -0,0 +1,36 @@
From df34e45c71cff889927a412c6296d02866cdc5cc Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Sun, 14 Feb 2021 23:51:45 -0500
Subject: [PATCH 20/46] libext2fs: fix crash when ext2fs_mmp_stop() is called
before MMP is initialized
Content-Type: text/plain
The fatal_error() function in e2fsck can call ext2fs_mmp_stop() on a
file system where MMP hasn't yet been initialized. When that happens,
instead of crashing, have ext2fs_mmp_stop() return success, since mmp
doesn't need to be stopped if it hasn't even been initialized yet.
Addresses-Debian-Bug: #696609
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/mmp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/ext2fs/mmp.c b/lib/ext2fs/mmp.c
index 973b9ecd..eddc66a7 100644
--- a/lib/ext2fs/mmp.c
+++ b/lib/ext2fs/mmp.c
@@ -401,7 +401,8 @@ errcode_t ext2fs_mmp_stop(ext2_filsys fs)
errcode_t retval = 0;
if (!ext2fs_has_feature_mmp(fs->super) ||
- !(fs->flags & EXT2_FLAG_RW) || (fs->flags & EXT2_FLAG_SKIP_MMP))
+ !(fs->flags & EXT2_FLAG_RW) || (fs->flags & EXT2_FLAG_SKIP_MMP) ||
+ (fs->mmp_buf == NULL) || (fs->mmp_cmp == NULL))
goto mmp_error;
retval = ext2fs_mmp_read(fs, fs->super->s_mmp_block, fs->mmp_buf);
--
2.35.1

52
SOURCES/e2fsprogs-1.45.6-libext2fs-fix-incorrect-negative-error-return-in-uni.patch Normal file
View File

@ -0,0 +1,52 @@
From c951a12b1594158bb87fbc4d8a89b326c34e711f Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Thu, 21 Jan 2021 16:00:01 -0500
Subject: [PATCH 15/46] libext2fs: fix incorrect negative error return in unix
and sparse io managers
Content-Type: text/plain
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/sparse_io.c | 4 ++--
lib/ext2fs/unix_io.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/ext2fs/sparse_io.c b/lib/ext2fs/sparse_io.c
index 5e0e2cd9..f287e76d 100644
--- a/lib/ext2fs/sparse_io.c
+++ b/lib/ext2fs/sparse_io.c
@@ -138,7 +138,7 @@ static errcode_t io_manager_configure(struct sparse_io_params *params,
retval = io_manager_import_sparse(params, sm, io);
if (retval) {
if (!params->block_size || !params->blocks_count) {
- retval = -EINVAL;
+ retval = EINVAL;
goto err_params;
}
sm->block_size = params->block_size;
@@ -229,7 +229,7 @@ static errcode_t read_sparse_argv(const char *name, bool is_fd,
if (ret < 1) {
free(sparse_params->file);
- return -EINVAL;
+ return EINVAL;
}
return 0;
}
diff --git a/lib/ext2fs/unix_io.c b/lib/ext2fs/unix_io.c
index 628e60c3..2bcd435c 100644
--- a/lib/ext2fs/unix_io.c
+++ b/lib/ext2fs/unix_io.c
@@ -733,7 +733,7 @@ static errcode_t unixfd_open(const char *str_fd, int flags,
#if defined(HAVE_FCNTL)
fd_flags = fcntl(fd, F_GETFD);
if (fd_flags == -1)
- return -EBADF;
+ return EBADF;
flags = 0;
if (fd_flags & O_RDWR)
--
2.35.1

40
SOURCES/e2fsprogs-1.45.6-libext2fs-fix-potential-buffer-overrun-in-__get_dire.patch Normal file
View File

@ -0,0 +1,40 @@
From b7466a55e89aa6d6a649734f2b1b24a03390bcef Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Wed, 26 Aug 2020 16:29:29 -0400
Subject: [PATCH 08/46] libext2fs: fix potential buffer overrun in
__get_dirent_tail()
Content-Type: text/plain
If the file system is corrupted, there is a potential of a read-only
buffer overrun. Fortunately, we don't actually use the result of that
pointer dereference, and the overrun is at most 64k.
Google-Bug-Id: #158564737
Fixes: eb88b751745b ("libext2fs: make ext2fs_dirent_has_tail() more strict")
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/csum.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/lib/ext2fs/csum.c b/lib/ext2fs/csum.c
index a7172580..2151003b 100644
--- a/lib/ext2fs/csum.c
+++ b/lib/ext2fs/csum.c
@@ -266,12 +266,11 @@ static errcode_t __get_dirent_tail(ext2_filsys fs,
d = dirent;
top = EXT2_DIRENT_TAIL(dirent, fs->blocksize);
- rec_len = translate(d->rec_len);
while ((void *) d < top) {
+ rec_len = translate(d->rec_len);
if ((rec_len < 8) || (rec_len & 0x03))
return EXT2_ET_DIR_CORRUPTED;
d = (struct ext2_dir_entry *)(((char *)d) + rec_len);
- rec_len = translate(d->rec_len);
}
if ((void *)d > ((void *)dirent + fs->blocksize))
--
2.35.1

212
SOURCES/e2fsprogs-1.45.6-libext2fs-fix-segault-when-setting-an-xattr-with-an-.patch Normal file
View File

@ -0,0 +1,212 @@
From 9beb50cd2c05f69f1231eb1f4579d6770ef48359 Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Sun, 7 Feb 2021 23:21:58 -0500
Subject: [PATCH 18/46] libext2fs: fix segault when setting an xattr with an
unknown prefix
Content-Type: text/plain
Also avoid unnecessary calls to find_ea_index() by caching the short
name and name index in the ext2_attr structure.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
---
lib/ext2fs/ext_attr.c | 64 +++++++++++++++++++++----------------------
1 file changed, 32 insertions(+), 32 deletions(-)
diff --git a/lib/ext2fs/ext_attr.c b/lib/ext2fs/ext_attr.c
index 871319a5..8a7a17cf 100644
--- a/lib/ext2fs/ext_attr.c
+++ b/lib/ext2fs/ext_attr.c
@@ -293,7 +293,9 @@ errcode_t ext2fs_adjust_ea_refcount(ext2_filsys fs, blk_t blk,
/* Manipulate the contents of extended attribute regions */
struct ext2_xattr {
+ int name_index;
char *name;
+ char *short_name;
void *value;
unsigned int value_len;
ext2_ino_t ea_ino;
@@ -643,29 +645,23 @@ write_xattrs_to_buffer(ext2_filsys fs, struct ext2_xattr *attrs, int count,
struct ext2_xattr *x;
struct ext2_ext_attr_entry *e = entries_start;
char *end = (char *) entries_start + storage_size;
- const char *shortname;
unsigned int value_size;
- int idx, ret;
errcode_t err;
memset(entries_start, 0, storage_size);
for (x = attrs; x < attrs + count; x++) {
- /* Calculate index and shortname position */
- shortname = x->name;
- ret = find_ea_index(x->name, &shortname, &idx);
-
value_size = ((x->value_len + EXT2_EXT_ATTR_PAD - 1) /
EXT2_EXT_ATTR_PAD) * EXT2_EXT_ATTR_PAD;
/* Fill out e appropriately */
- e->e_name_len = strlen(shortname);
- e->e_name_index = (ret ? idx : 0);
+ e->e_name_len = strlen(x->short_name);
+ e->e_name_index = x->name_index;
e->e_value_size = x->value_len;
e->e_value_inum = x->ea_ino;
/* Store name */
- memcpy((char *)e + sizeof(*e), shortname, e->e_name_len);
+ memcpy((char *)e + sizeof(*e), x->short_name, e->e_name_len);
if (x->ea_ino) {
e->e_value_offs = 0;
} else {
@@ -875,6 +871,8 @@ static errcode_t read_xattrs_from_buffer(struct ext2_xattr_handle *handle,
memcpy(x->name + prefix_len,
(char *)entry + sizeof(*entry),
entry->e_name_len);
+ x->short_name = x->name + prefix_len;
+ x->name_index = entry->e_name_index;
/* Check & copy value */
if (!ext2fs_has_feature_ea_inode(handle->fs->super) &&
@@ -1302,7 +1300,8 @@ out:
}
static errcode_t xattr_update_entry(ext2_filsys fs, struct ext2_xattr *x,
- const char *name, const void *value,
+ const char *name, const char *short_name,
+ int index, const void *value,
size_t value_len, int in_inode)
{
ext2_ino_t ea_ino = 0;
@@ -1336,8 +1335,11 @@ static errcode_t xattr_update_entry(ext2_filsys fs, struct ext2_xattr *x,
goto fail;
}
- if (!x->name)
+ if (!x->name) {
x->name = new_name;
+ x->short_name = new_name + (short_name - name);
+ }
+ x->name_index = index;
if (x->value)
ext2fs_free_mem(&x->value);
@@ -1356,31 +1358,27 @@ fail:
}
static int xattr_find_position(struct ext2_xattr *attrs, int count,
- const char *name)
+ const char *shortname, int name_idx)
{
struct ext2_xattr *x;
int i;
- const char *shortname, *x_shortname;
- int name_idx, x_name_idx;
int shortname_len, x_shortname_len;
- find_ea_index(name, &shortname, &name_idx);
shortname_len = strlen(shortname);
for (i = 0, x = attrs; i < count; i++, x++) {
- find_ea_index(x->name, &x_shortname, &x_name_idx);
- if (name_idx < x_name_idx)
+ if (name_idx < x->name_index)
break;
- if (name_idx > x_name_idx)
+ if (name_idx > x->name_index)
continue;
- x_shortname_len = strlen(x_shortname);
+ x_shortname_len = strlen(x->short_name);
if (shortname_len < x_shortname_len)
break;
if (shortname_len > x_shortname_len)
continue;
- if (memcmp(shortname, x_shortname, shortname_len) <= 0)
+ if (memcmp(shortname, x->short_name, shortname_len) <= 0)
break;
}
return i;
@@ -1395,8 +1393,8 @@ static errcode_t xattr_array_update(struct ext2_xattr_handle *h,
struct ext2_xattr tmp;
int add_to_ibody;
int needed;
- int name_len, name_idx;
- const char *shortname;
+ int name_len, name_idx = 0;
+ const char *shortname = name;
int new_idx;
int ret;
@@ -1423,7 +1421,8 @@ static errcode_t xattr_array_update(struct ext2_xattr_handle *h,
/* Update the existing entry. */
ret = xattr_update_entry(h->fs, &h->attrs[old_idx], name,
- value, value_len, in_inode);
+ shortname, name_idx, value,
+ value_len, in_inode);
if (ret)
return ret;
if (h->ibody_count <= old_idx) {
@@ -1451,7 +1450,8 @@ static errcode_t xattr_array_update(struct ext2_xattr_handle *h,
if (old_idx >= 0) {
/* Update the existing entry. */
ret = xattr_update_entry(h->fs, &h->attrs[old_idx], name,
- value, value_len, in_inode);
+ shortname, name_idx, value,
+ value_len, in_inode);
if (ret)
return ret;
if (old_idx < h->ibody_count) {
@@ -1460,7 +1460,8 @@ static errcode_t xattr_array_update(struct ext2_xattr_handle *h,
* entries in the block are sorted.
*/
new_idx = xattr_find_position(h->attrs + h->ibody_count,
- h->count - h->ibody_count, name);
+ h->count - h->ibody_count,
+ shortname, name_idx);
new_idx += h->ibody_count - 1;
tmp = h->attrs[old_idx];
memmove(h->attrs + old_idx, h->attrs + old_idx + 1,
@@ -1472,7 +1473,8 @@ static errcode_t xattr_array_update(struct ext2_xattr_handle *h,
}
new_idx = xattr_find_position(h->attrs + h->ibody_count,
- h->count - h->ibody_count, name);
+ h->count - h->ibody_count,
+ shortname, name_idx);
new_idx += h->ibody_count;
add_to_ibody = 0;
@@ -1483,8 +1485,8 @@ add_new:
return ret;
}
- ret = xattr_update_entry(h->fs, &h->attrs[h->count], name, value,
- value_len, in_inode);
+ ret = xattr_update_entry(h->fs, &h->attrs[h->count], name, shortname,
+ name_idx, value, value_len, in_inode);
if (ret)
return ret;
@@ -1502,12 +1504,10 @@ static int space_used(struct ext2_xattr *attrs, int count)
{
int total = 0;
struct ext2_xattr *x;
- const char *shortname;
- int i, len, name_idx;
+ int i, len;
for (i = 0, x = attrs; i < count; i++, x++) {
- find_ea_index(x->name, &shortname, &name_idx);
- len = strlen(shortname);
+ len = strlen(x->short_name);
total += EXT2_EXT_ATTR_LEN(len);
if (!x->ea_ino)
total += EXT2_EXT_ATTR_SIZE(x->value_len);
--
2.35.1

39
SOURCES/e2fsprogs-1.45.6-libext2fs-fix-unexpected-NULL-variable.patch Normal file
View File

@ -0,0 +1,39 @@
From 92d055879d510a1a51315301ea788445cd11aacb Mon Sep 17 00:00:00 2001
From: Lukas Czerner <lczerner@redhat.com>
Date: Fri, 6 Aug 2021 11:58:16 +0200
Subject: [PATCH 40/46] libext2fs: fix unexpected NULL variable
Content-Type: text/plain
The ext2fs_check_mount_point() function can be called with mtpt being
NULL as for example from ext2fs_check_if_mounted(). However in the
is_swap_device condition we use the mtpt in strncpy without checking
whether it is non-null first.
This should not be a problem on linux since the previous attempt to open
the device exclusively would have prevented us from ever reaching the
problematic strncpy. However it's still a bug and can cause problems on
other systems, fix it by conditioning strncpy on mtpt not being null.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
lib/ext2fs/ismounted.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/ext2fs/ismounted.c b/lib/ext2fs/ismounted.c
index 46d330d9..c28475d4 100644
--- a/lib/ext2fs/ismounted.c
+++ b/lib/ext2fs/ismounted.c
@@ -393,7 +393,8 @@ errcode_t ext2fs_check_mount_point(const char *device, int *mount_flags,
if (is_swap_device(device)) {
*mount_flags = EXT2_MF_MOUNTED | EXT2_MF_SWAP;
- strncpy(mtpt, "<swap>", mtlen);
+ if (mtpt)
+ strncpy(mtpt, "<swap>", mtlen);
} else {
#ifdef HAVE_SETMNTENT
retval = check_mntent(device, mount_flags, mtpt, mtlen);
--
2.35.1

118
SOURCES/e2fsprogs-1.45.6-libext2fs-remove-augmented-rbtree-functionality.patch Normal file
View File

@ -0,0 +1,118 @@
From 1a95588e8090a2ac6cab364e5a24be219f50710b Mon Sep 17 00:00:00 2001
From: Lukas Czerner <lczerner@redhat.com>
Date: Fri, 6 Aug 2021 11:58:17 +0200
Subject: [PATCH 41/46] libext2fs: remove augmented rbtree functionality
Content-Type: text/plain
Rbtree code was originally taken from linux kernel. This includes the
augmented rbtree functionality, however this was never intended to be
used and is not used still. Just remove it.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
lib/ext2fs/rbtree.c | 68 ---------------------------------------------
lib/ext2fs/rbtree.h | 8 ------
2 files changed, 76 deletions(-)
diff --git a/lib/ext2fs/rbtree.c b/lib/ext2fs/rbtree.c
index 5b92099d..74426fa6 100644
--- a/lib/ext2fs/rbtree.c
+++ b/lib/ext2fs/rbtree.c
@@ -280,74 +280,6 @@ void ext2fs_rb_erase(struct rb_node *node, struct rb_root *root)
__rb_erase_color(child, parent, root);
}
-static void ext2fs_rb_augment_path(struct rb_node *node, rb_augment_f func, void *data)
-{
- struct rb_node *parent;
-
-up:
- func(node, data);
- parent = ext2fs_rb_parent(node);
- if (!parent)
- return;
-
- if (node == parent->rb_left && parent->rb_right)
- func(parent->rb_right, data);
- else if (parent->rb_left)
- func(parent->rb_left, data);
-
- node = parent;
- goto up;
-}
-
-/*
- * after inserting @node into the tree, update the tree to account for
- * both the new entry and any damage done by rebalance
- */
-void ext2fs_rb_augment_insert(struct rb_node *node, rb_augment_f func, void *data)
-{
- if (node->rb_left)
- node = node->rb_left;
- else if (node->rb_right)
- node = node->rb_right;
-
- ext2fs_rb_augment_path(node, func, data);
-}
-
-/*
- * before removing the node, find the deepest node on the rebalance path
- * that will still be there after @node gets removed
- */
-struct rb_node *ext2fs_rb_augment_erase_begin(struct rb_node *node)
-{
- struct rb_node *deepest;
-
- if (!node->rb_right && !node->rb_left)
- deepest = ext2fs_rb_parent(node);
- else if (!node->rb_right)
- deepest = node->rb_left;
- else if (!node->rb_left)
- deepest = node->rb_right;