diff --git a/e2fsck-fix-free-pointer-dereferences.patch b/e2fsck-fix-free-pointer-dereferences.patch new file mode 100644 index 0000000..2195de8 --- /dev/null +++ b/e2fsck-fix-free-pointer-dereferences.patch @@ -0,0 +1,47 @@ +From ebdf895b43a1ce499e4d2556a201e2a753fc422f Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Wed, 8 Oct 2014 11:18:41 -0400 +Subject: [PATCH] e2fsck: fix free pointer dereferences +References: bnc#912229 + +Commit 47fee2ef6a23a introduces some free pointer dereference bugs by +not clearing ctx->fs after calling ext2fs_close_free(). + +Reported-by: Matthias Andree +Cc: Lukas Czerner +Signed-off-by: Theodore Ts'o +--- + e2fsck/unix.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +Index: e2fsprogs-1.42.11/e2fsck/unix.c +=================================================================== +--- e2fsprogs-1.42.11.orig/e2fsck/unix.c ++++ e2fsprogs-1.42.11/e2fsck/unix.c +@@ -459,7 +459,7 @@ static void check_if_skip(e2fsck_t ctx) + } + log_out(ctx, "\n"); + skip: +- ext2fs_close_free(&fs); ++ ext2fs_close_free(&ctx->fs); + e2fsck_free_context(ctx); + exit(FSCK_OK); + } +@@ -1465,7 +1465,7 @@ failure: + /* + * Restart in order to reopen fs but this time start mmp. + */ +- ext2fs_close_free(&fs); ++ ext2fs_close_free(&ctx->fs); + flags &= ~EXT2_FLAG_SKIP_MMP; + goto restart; + } +@@ -1695,7 +1695,7 @@ no_journal: + _("while resetting context")); + fatal_error(ctx, 0); + } +- ext2fs_close_free(&fs); ++ ext2fs_close_free(&ctx->fs); + goto restart; + } + if (run_result & E2F_FLAG_CANCEL) { diff --git a/e2fsck-free-ctx-fs-not-fs-at-the-end-of-fsck.patch b/e2fsck-free-ctx-fs-not-fs-at-the-end-of-fsck.patch new file mode 100644 index 0000000..f08261d --- /dev/null +++ b/e2fsck-free-ctx-fs-not-fs-at-the-end-of-fsck.patch @@ -0,0 +1,34 @@ +From a82d88ea99d3c5c21bf538b886da0482bf143fd5 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Thu, 24 Jul 2014 21:03:54 -0400 +Subject: [PATCH] e2fsck: free ctx->fs, not fs, at the end of fsck +References: bnc#912229 + +When we call ext2fs_close_free at the end of main(), we need to supply +the address of ctx->fs, because the subsequent e2fsck_free_context +call will try to access ctx->fs (which is now set to a freed block) to +see if it should free the directory block list. This is clearly not +desirable, so fix the problem. + +Signed-off-by: Darrick J. Wong +Signed-off-by: Theodore Ts'o +--- + e2fsck/unix.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/e2fsck/unix.c b/e2fsck/unix.c +index 8d1bdf3e03cb..fc05bdeec257 100644 +--- a/e2fsck/unix.c ++++ b/e2fsck/unix.c +@@ -1774,7 +1774,7 @@ no_journal: + io_channel_flush(ctx->fs->io); + print_resource_track(ctx, NULL, &ctx->global_rtrack, ctx->fs->io); + +- ext2fs_close_free(&fs); ++ ext2fs_close_free(&ctx->fs); + free(ctx->journal_name); + + e2fsck_free_context(ctx); +-- +2.1.2 + diff --git a/e2fsprogs.changes b/e2fsprogs.changes index 80cced6..c4c5ed3 100644 --- a/e2fsprogs.changes +++ b/e2fsprogs.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Fri Jan 9 09:05:27 UTC 2015 - jack@suse.cz + +- e2fsck-fix-free-pointer-dereferences.patch: + e2fsck-free-ctx-fs-not-fs-at-the-end-of-fsck.patch: + Fix use after free issues (bnc#912229) + ------------------------------------------------------------------- Mon Jul 21 17:54:46 UTC 2014 - jack@suse.cz diff --git a/e2fsprogs.spec b/e2fsprogs.spec index e65919b..d4a5ecd 100644 --- a/e2fsprogs.spec +++ b/e2fsprogs.spec @@ -1,7 +1,7 @@ # # spec file for package e2fsprogs # -# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2015 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -60,6 +60,9 @@ Patch1: e2fsprogs-1.41.1-splash_support.patch Patch3: libcom_err-compile_et_permissions.patch Patch4: e2fsprogs-1.42-implicit_fortify_decl.patch Patch5: e2fsprogs-1.42-ext2fsh_implicit.patch +Patch6: e2fsck-free-ctx-fs-not-fs-at-the-end-of-fsck.patch +Patch7: e2fsck-fix-free-pointer-dereferences.patch + # Do not suppress make commands BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -141,6 +144,8 @@ Development files for the com_err error message display library. %patch3 -p1 %patch4 %patch5 +%patch6 -p1 +%patch7 -p1 cp %{SOURCE2} . %build