diff --git a/SOURCES/e2fsprogs-1.42.9-defrag-backwards-files.patch b/SOURCES/e2fsprogs-1.42.9-defrag-backwards-files.patch new file mode 100644 index 0000000..9d71f5d --- /dev/null +++ b/SOURCES/e2fsprogs-1.42.9-defrag-backwards-files.patch @@ -0,0 +1,39 @@ +commit c7c539e8fd86de691475eea00409c6c030f312cd +Author: Darrick J. Wong +Date: Tue Jul 22 12:40:56 2014 -0400 + + e4defrag: backwards-allocated files should be defragmented too + + Currently, e4defrag avoids increasing file fragmentation by comparing + the number of runs of physical extents of both the original and the + donor files. Unfortunately, there is a bug in the routine that counts + physical extents, since it doesn't look at the logical block offsets + of the extents. Therefore, a file whose blocks were allocated in + reverse order will be seen as only having one big physical extent, and + therefore will not be defragmented. + + Fix the counting routine to consider logical extent offset so that we + defragment backwards-allocated files. This could be problematic if we + ever gain the ability to lay out logically sparse extents in a + physically contiguous manner, but presumably one wouldn't call defrag + on such a file. + + Reported-by: Xiaoguang Wang + Signed-off-by: Darrick J. Wong + Signed-off-by: Theodore Ts'o + +Index: e2fsprogs-1.42.9/misc/e4defrag.c +=================================================================== +--- e2fsprogs-1.42.9.orig/misc/e4defrag.c ++++ e2fsprogs-1.42.9/misc/e4defrag.c +@@ -941,7 +941,9 @@ static int get_physical_count(struct fie + + do { + if ((ext_list_tmp->data.physical + ext_list_tmp->data.len) +- != ext_list_tmp->next->data.physical) { ++ != ext_list_tmp->next->data.physical || ++ (ext_list_tmp->data.logical + ext_list_tmp->data.len) ++ != ext_list_tmp->next->data.logical) { + /* This extent and next extent are not continuous. */ + ret++; + } diff --git a/SOURCES/e2fsprogs-1.42.9-force-journal-remove.patch b/SOURCES/e2fsprogs-1.42.9-force-journal-remove.patch new file mode 100644 index 0000000..fa32af2 --- /dev/null +++ b/SOURCES/e2fsprogs-1.42.9-force-journal-remove.patch @@ -0,0 +1,63 @@ +commit 5fe2bd60844cfe5d805e62a4316afaa5cd9d7c83 +Author: Eric Sandeen +Date: Thu Feb 20 20:18:41 2014 -0500 + + tune2fs: allow removal of dirty journal with two "-f" options + + Jim pointed out that "tune2fs -f -O ^has_journal" won't remove the + journal if the needs_recovery flag is set; the manpage seems to indicate + that it should. And if you've lost an external journal and can no longer + replay it, how should one proceed? + + Change tune2fs so that two "-f" options will allow removal of a dirty + journal from a filesystem, even if the filesystem needs recovery. + + e2fsck can then do its best to pick up the pieces. + + Addresses-Debian-Bug: #559301 + + Reported-by: Jim Faulkner + Signed-off-by: Eric Sandeen + Signed-off-by: "Theodore Ts'o" + +Index: e2fsprogs-1.42.9/misc/tune2fs.8.in +=================================================================== +--- e2fsprogs-1.42.9.orig/misc/tune2fs.8.in ++++ e2fsprogs-1.42.9/misc/tune2fs.8.in +@@ -248,7 +248,10 @@ option is useful when removing the + filesystem feature from a filesystem which has + an external journal (or is corrupted + such that it appears to have an external journal), but that +-external journal is not available. ++external journal is not available. If the filesystem appears to require ++journal replay, the ++.B \-f ++flag must be specified twice to proceed. + .sp + .B WARNING: + Removing an external journal from a filesystem which was not cleanly unmounted +Index: e2fsprogs-1.42.9/misc/tune2fs.c +=================================================================== +--- e2fsprogs-1.42.9.orig/misc/tune2fs.c ++++ e2fsprogs-1.42.9/misc/tune2fs.c +@@ -436,8 +436,9 @@ static int update_feature_set(ext2_filsy + "read-only.\n"), stderr); + return 1; + } +- if (sb->s_feature_incompat & +- EXT3_FEATURE_INCOMPAT_RECOVER) { ++ if ((sb->s_feature_incompat & ++ EXT3_FEATURE_INCOMPAT_RECOVER) && ++ f_flag < 2) { + fputs(_("The needs_recovery flag is set. " + "Please run e2fsck before clearing\n" + "the has_journal flag.\n"), stderr); +@@ -929,7 +930,7 @@ static void parse_tune2fs_options(int ar + open_flag |= EXT2_FLAG_RW; + break; + case 'f': /* Force */ +- f_flag = 1; ++ f_flag++; + break; + case 'g': + resgid = strtoul(optarg, &tmp, 0); diff --git a/SOURCES/e2fsprogs-1.42.9-libext2fs-avoid-buffer-overflow.patch b/SOURCES/e2fsprogs-1.42.9-libext2fs-avoid-buffer-overflow.patch new file mode 100644 index 0000000..dd9634d --- /dev/null +++ b/SOURCES/e2fsprogs-1.42.9-libext2fs-avoid-buffer-overflow.patch @@ -0,0 +1,52 @@ +commit f66e6ce4446738c2c7f43d41988a3eb73347e2f5 +Author: Theodore Ts'o +Date: Sat Aug 9 12:24:54 2014 -0400 + + libext2fs: avoid buffer overflow if s_first_meta_bg is too big + + If s_first_meta_bg is greater than the of number block group + descriptor blocks, then reading or writing the block group descriptors + will end up overruning the memory buffer allocated for the + descriptors. Fix this by limiting first_meta_bg to no more than + fs->desc_blocks. This doesn't correct the bad s_first_meta_bg value, + but it avoids causing the e2fsprogs userspace programs from + potentially crashing. + + Signed-off-by: Theodore Ts'o + +Index: e2fsprogs-1.42.9/lib/ext2fs/closefs.c +=================================================================== +--- e2fsprogs-1.42.9.orig/lib/ext2fs/closefs.c ++++ e2fsprogs-1.42.9/lib/ext2fs/closefs.c +@@ -336,9 +336,11 @@ errcode_t ext2fs_flush2(ext2_filsys fs, + * superblocks and group descriptors. + */ + group_ptr = (char *) group_shadow; +- if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) ++ if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) { + old_desc_blocks = fs->super->s_first_meta_bg; +- else ++ if (old_desc_blocks > fs->super->s_first_meta_bg) ++ old_desc_blocks = fs->desc_blocks; ++ } else + old_desc_blocks = fs->desc_blocks; + + ext2fs_numeric_progress_init(fs, &progress, NULL, +Index: e2fsprogs-1.42.9/lib/ext2fs/openfs.c +=================================================================== +--- e2fsprogs-1.42.9.orig/lib/ext2fs/openfs.c ++++ e2fsprogs-1.42.9/lib/ext2fs/openfs.c +@@ -348,9 +348,11 @@ errcode_t ext2fs_open2(const char *name, + #ifdef WORDS_BIGENDIAN + groups_per_block = EXT2_DESC_PER_BLOCK(fs->super); + #endif +- if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) ++ if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) { + first_meta_bg = fs->super->s_first_meta_bg; +- else ++ if (first_meta_bg > fs->desc_blocks) ++ first_meta_bg = fs->desc_blocks; ++ } else + first_meta_bg = fs->desc_blocks; + if (first_meta_bg) { + retval = io_channel_read_blk(fs->io, group_block+1, diff --git a/SOURCES/e2fsprogs-1.42.9-libext2fs-buffer-overflow-closefs.patch b/SOURCES/e2fsprogs-1.42.9-libext2fs-buffer-overflow-closefs.patch new file mode 100644 index 0000000..abb293f --- /dev/null +++ b/SOURCES/e2fsprogs-1.42.9-libext2fs-buffer-overflow-closefs.patch @@ -0,0 +1,51 @@ +commit 49d0fe2a14f2a23da2fe299643379b8c1d37df73 +Author: Theodore Ts'o +Date: Fri Feb 6 12:46:39 2015 -0500 + + libext2fs: fix potential buffer overflow in closefs() + + The bug fix in f66e6ce4446: "libext2fs: avoid buffer overflow if + s_first_meta_bg is too big" had a typo in the fix for + ext2fs_closefs(). In practice most of the security exposure was from + the openfs path, since this meant if there was a carefully crafted + file system, buffer overrun would be triggered when the file system was + opened. + + However, if corrupted file system didn't trip over some corruption + check, and then the file system was modified via tune2fs or debugfs, + such that the superblock was marked dirty and then written out via the + closefs() path, it's possible that the buffer overrun could be + triggered when the file system is closed. + + Also clear up a signed vs unsigned warning while we're at it. + + Thanks to Nick Kralevich for asking me to look at + compiler warning in the code in question, which led me to notice the + bug in f66e6ce4446. + + Addresses: CVE-2015-1572 + + Signed-off-by: Theodore Ts'o + +Index: e2fsprogs-1.42.9/lib/ext2fs/closefs.c +=================================================================== +--- e2fsprogs-1.42.9.orig/lib/ext2fs/closefs.c ++++ e2fsprogs-1.42.9/lib/ext2fs/closefs.c +@@ -279,7 +279,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, + dgrp_t j; + #endif + char *group_ptr; +- int old_desc_blocks; ++ blk64_t old_desc_blocks; + struct ext2fs_numeric_progress_struct progress; + + EXT2_CHECK_MAGIC(fs, EXT2_ET_MAGIC_EXT2FS_FILSYS); +@@ -338,7 +338,7 @@ errcode_t ext2fs_flush2(ext2_filsys fs, + group_ptr = (char *) group_shadow; + if (fs->super->s_feature_incompat & EXT2_FEATURE_INCOMPAT_META_BG) { + old_desc_blocks = fs->super->s_first_meta_bg; +- if (old_desc_blocks > fs->super->s_first_meta_bg) ++ if (old_desc_blocks > fs->desc_blocks) + old_desc_blocks = fs->desc_blocks; + } else + old_desc_blocks = fs->desc_blocks; diff --git a/SOURCES/e2fsprogs-1.42.9-mkfs-revision-too-high.patch b/SOURCES/e2fsprogs-1.42.9-mkfs-revision-too-high.patch new file mode 100644 index 0000000..459c4e0 --- /dev/null +++ b/SOURCES/e2fsprogs-1.42.9-mkfs-revision-too-high.patch @@ -0,0 +1,37 @@ +commit 4b59352edb5ce783ba578d708de1fda981acfec6 +Author: Frank Sorenson +Date: Fri Jul 4 15:31:50 2014 -0400 + + mke2fs: prevent creation of filesystem with unsupported revision + + It's a bit strange to accept revision levels higher than + the code creating the filesystem can understand, so don't + allow it. + + At least the kernel will mount the fs readonly if it's too + high, but no other utility will touch it, so you can't + fix the error. + + Just reject anything > EXT2_MAX_SUPP_REV at mkfs time. + + Signed-off-by: Frank Sorenson + [sandeen@redhat.com: Add more verbose commit log] + Signed-off-by: Eric Sandeen + Signed-off-by: Theodore Ts'o + +Index: e2fsprogs-1.42.9/misc/mke2fs.c +=================================================================== +--- e2fsprogs-1.42.9.orig/misc/mke2fs.c ++++ e2fsprogs-1.42.9/misc/mke2fs.c +@@ -1570,6 +1570,11 @@ profile_error: + _("bad revision level - %s"), optarg); + exit(1); + } ++ if (r_opt > EXT2_MAX_SUPP_REV) { ++ com_err(program_name, EXT2_ET_REV_TOO_HIGH, ++ _("while trying to create revision %d"), r_opt); ++ exit(1); ++ } + fs_param.s_rev_level = r_opt; + break; + case 's': /* deprecated */ diff --git a/SOURCES/e2fsprogs-1.42.9-resize2fs-clear-uninit-BG.patch b/SOURCES/e2fsprogs-1.42.9-resize2fs-clear-uninit-BG.patch new file mode 100644 index 0000000..f0ebf61 --- /dev/null +++ b/SOURCES/e2fsprogs-1.42.9-resize2fs-clear-uninit-BG.patch @@ -0,0 +1,85 @@ +commit f3745728bc254892da4c569ba3fd8801895f3524 +Author: Eric Sandeen +Date: Sun Mar 6 21:51:23 2016 -0500 + + resize2fs: clear uninit BG if allocating from new group + + If resize2fs_get_alloc_block() allocates from a BLOCK_UNINIT group, we + need to make sure that the UNINIT flag is cleared on both file system + structures which are maintained by resize2fs. This causes the + modified bitmaps to not get written out, which leads to post-resize2fs + e2fsck errors; used blocks in UNINIT groups, not marked in the block + bitmap. This was seen on r_ext4_small_bg. + + This patch uses clear_block_uninit() to clear the flag, + and my problem goes away. + + Signed-off-by: Eric Sandeen + Reviewed-by: Darrick J. Wong + Reviewed-by: Andreas Dilger + Signed-off-by: Theodore Ts'o + +Index: e2fsprogs-1.42.9/lib/ext2fs/alloc.c +=================================================================== +--- e2fsprogs-1.42.9.orig/lib/ext2fs/alloc.c ++++ e2fsprogs-1.42.9/lib/ext2fs/alloc.c +@@ -27,6 +27,22 @@ + #include "ext2fs.h" + + /* ++ * Clear the uninit block bitmap flag if necessary ++ */ ++void ext2fs_clear_block_uninit(ext2_filsys fs, dgrp_t group) ++{ ++ if (!(ext2fs_bg_flags_test(fs, group, EXT2_BG_BLOCK_UNINIT))) ++ return; ++ ++ /* uninit block bitmaps are now initialized in read_bitmaps() */ ++ ++ ext2fs_bg_flags_clear(fs, group, EXT2_BG_BLOCK_UNINIT); ++ ext2fs_group_desc_csum_set(fs, group); ++ ext2fs_mark_super_dirty(fs); ++ ext2fs_mark_bb_dirty(fs); ++} ++ ++/* + * Check for uninit block bitmaps and deal with them appropriately + */ + static void check_block_uninit(ext2_filsys fs, ext2fs_block_bitmap map, +Index: e2fsprogs-1.42.9/lib/ext2fs/ext2fs.h +=================================================================== +--- e2fsprogs-1.42.9.orig/lib/ext2fs/ext2fs.h ++++ e2fsprogs-1.42.9/lib/ext2fs/ext2fs.h +@@ -639,6 +639,7 @@ static inline int ext2fs_needs_large_fil + } + + /* alloc.c */ ++extern void ext2fs_clear_block_uninit(ext2_filsys fs, dgrp_t group); + extern errcode_t ext2fs_new_inode(ext2_filsys fs, ext2_ino_t dir, int mode, + ext2fs_inode_bitmap map, ext2_ino_t *ret); + extern errcode_t ext2fs_new_block(ext2_filsys fs, blk_t goal, +Index: e2fsprogs-1.42.9/resize/resize2fs.c +=================================================================== +--- e2fsprogs-1.42.9.orig/resize/resize2fs.c ++++ e2fsprogs-1.42.9/resize/resize2fs.c +@@ -1196,6 +1196,7 @@ static errcode_t resize2fs_get_alloc_blo + { + ext2_resize_t rfs = (ext2_resize_t) fs->priv_data; + blk64_t blk; ++ int group; + + blk = get_new_block(rfs); + if (!blk) +@@ -1208,6 +1209,12 @@ static errcode_t resize2fs_get_alloc_blo + + ext2fs_mark_block_bitmap2(rfs->old_fs->block_map, blk); + ext2fs_mark_block_bitmap2(rfs->new_fs->block_map, blk); ++ ++ group = ext2fs_group_of_blk2(rfs->old_fs, blk); ++ ext2fs_clear_block_uninit(rfs->old_fs, group); ++ group = ext2fs_group_of_blk2(rfs->new_fs, blk); ++ ext2fs_clear_block_uninit(rfs->new_fs, group); ++ + *ret = (blk64_t) blk; + return 0; + } diff --git a/SPECS/e2fsprogs.spec b/SPECS/e2fsprogs.spec index acce0e1..9cc5b37 100644 --- a/SPECS/e2fsprogs.spec +++ b/SPECS/e2fsprogs.spec @@ -1,7 +1,7 @@ Summary: Utilities for managing ext2, ext3, and ext4 filesystems Name: e2fsprogs Version: 1.42.9 -Release: 7%{?dist} +Release: 9%{?dist} # License tags based on COPYING file distinctions for various components License: GPLv2 @@ -26,6 +26,12 @@ Patch13: e2fsprogs-1.42.9-ext4-manpage-add-mountopts.patch Patch14: e2fsprogs-1.42.9-ext4-manpage-add-attrs.patch Patch15: e2fsprogs-1.42.9-fix-endian-handling-of-ext3_extent_header.patch Patch16: e2fsprogs-1.42.9-dont-require-fsck-for-resize-p.patch +Patch17: e2fsprogs-1.42.9-defrag-backwards-files.patch +Patch18: e2fsprogs-1.42.9-force-journal-remove.patch +Patch19: e2fsprogs-1.42.9-mkfs-revision-too-high.patch +Patch20: e2fsprogs-1.42.9-libext2fs-avoid-buffer-overflow.patch +Patch21: e2fsprogs-1.42.9-libext2fs-buffer-overflow-closefs.patch +Patch22: e2fsprogs-1.42.9-resize2fs-clear-uninit-BG.patch Url: http://e2fsprogs.sourceforge.net/ BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -191,6 +197,12 @@ It was originally inspired by the Multics SubSystem library. %patch14 -p1 %patch15 -p1 %patch16 -p1 +%patch17 -p1 +%patch18 -p1 +%patch19 -p1 +%patch20 -p1 +%patch21 -p1 +%patch22 -p1 %build %configure --enable-elf-shlibs --enable-nls --disable-uuidd --disable-fsck \ @@ -228,6 +240,10 @@ install -p -m 644 %{SOURCE2} %{buildroot}/etc/e2fsck.conf %find_lang %{name} %check +# This breaks in a very weird way on ppc; it is a test of a crafted +# filesystem that can't even be used in practice, and usptream +# has ignored the patch to fix it. So remove it for now. +rm -rf tests/r_ext4_small_bg make check %clean @@ -374,6 +390,15 @@ exit 0 %{_libdir}/pkgconfig/ss.pc %changelog +* Mon Jun 13 2016 Eric Sandeen 1.42.9-9 +- resize2fs: clear uninit BG if allocating from new group (#1262498) + +* Fri Feb 19 2016 Eric Sandeen 1.42.9-8 +- e4defrag: backwards-allocated files should be defragmented (#1176785) +- tune2fs: allow removal of dirty journal with two "-f" options (#1212376) +- mke2fs: prevent creation of filesystem with unsupported revision (#1212378) +- libext2fs: prevent buffer overflows (#1293677) + * Wed Jan 21 2015 Eric Sandeen 1.42.9-7 - Don't require e2fsck for resize2fs -P (#1183492)