Set link to e2fsprogs.323 via maintenance_release request

Rev SUSE:SLE-12:Update/1 Md5 032718ca9b5dc36fc8846032a969848d 2015-02-10 15:57:35 leonardocf None

e2fsck-fix-free-pointer-dereferences.patch

@@ -0,0 +1,47 @@
+From ebdf895b43a1ce499e4d2556a201e2a753fc422f Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 8 Oct 2014 11:18:41 -0400
+Subject: [PATCH] e2fsck: fix free pointer dereferences
+References: bnc#912229
+
+Commit 47fee2ef6a23a introduces some free pointer dereference bugs by
+not clearing ctx->fs after calling ext2fs_close_free().
+
+Reported-by: Matthias Andree <mandree@FreeBSD.org>
+Cc: Lukas Czerner <lczerner@redhat.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ e2fsck/unix.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+Index: e2fsprogs-1.42.11/e2fsck/unix.c
+===================================================================
+--- e2fsprogs-1.42.11.orig/e2fsck/unix.c
++++ e2fsprogs-1.42.11/e2fsck/unix.c
+@@ -459,7 +459,7 @@ static void check_if_skip(e2fsck_t ctx)
+ 	}
+ 	log_out(ctx, "\n");
+ skip:
+-	ext2fs_close_free(&fs);
++	ext2fs_close_free(&ctx->fs);
+ 	e2fsck_free_context(ctx);
+ 	exit(FSCK_OK);
+ }
+@@ -1465,7 +1465,7 @@ failure:
+ 		/*
+ 		 * Restart in order to reopen fs but this time start mmp.
+ 		 */
+-		ext2fs_close_free(&fs);
++		ext2fs_close_free(&ctx->fs);
+ 		flags &= ~EXT2_FLAG_SKIP_MMP;
+ 		goto restart;
+ 	}
+@@ -1695,7 +1695,7 @@ no_journal:
+ 				_("while resetting context"));
+ 			fatal_error(ctx, 0);
+ 		}
+-		ext2fs_close_free(&fs);
++		ext2fs_close_free(&ctx->fs);
+ 		goto restart;
+ 	}
+ 	if (run_result & E2F_FLAG_CANCEL) {

e2fsck-free-ctx-fs-not-fs-at-the-end-of-fsck.patch

@@ -0,0 +1,34 @@
+From a82d88ea99d3c5c21bf538b886da0482bf143fd5 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Thu, 24 Jul 2014 21:03:54 -0400
+Subject: [PATCH] e2fsck: free ctx->fs, not fs, at the end of fsck
+References: bnc#912229
+
+When we call ext2fs_close_free at the end of main(), we need to supply
+the address of ctx->fs, because the subsequent e2fsck_free_context
+call will try to access ctx->fs (which is now set to a freed block) to
+see if it should free the directory block list.  This is clearly not
+desirable, so fix the problem.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ e2fsck/unix.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/e2fsck/unix.c b/e2fsck/unix.c
+index 8d1bdf3e03cb..fc05bdeec257 100644
+--- a/e2fsck/unix.c
++++ b/e2fsck/unix.c
+@@ -1774,7 +1774,7 @@ no_journal:
+ 	io_channel_flush(ctx->fs->io);
+ 	print_resource_track(ctx, NULL, &ctx->global_rtrack, ctx->fs->io);
+ 
+-	ext2fs_close_free(&fs);
++	ext2fs_close_free(&ctx->fs);
+ 	free(ctx->journal_name);
+ 
+ 	e2fsck_free_context(ctx);
+-- 
+2.1.2
+

e2fsprogs.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Fri Jan  9 09:05:27 UTC 2015 - jack@suse.cz
+
+- e2fsck-fix-free-pointer-dereferences.patch:
+  e2fsck-free-ctx-fs-not-fs-at-the-end-of-fsck.patch:
+    Fix use after free issues (bnc#912229)
+
 -------------------------------------------------------------------
 Mon Jul 21 17:54:46 UTC 2014 - jack@suse.cz
 

e2fsprogs.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package e2fsprogs
 #
-# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany.
+# Copyright (c) 2015 SUSE LINUX Products GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -60,6 +60,9 @@ Patch1:         e2fsprogs-1.41.1-splash_support.patch
 Patch3:         libcom_err-compile_et_permissions.patch
 Patch4:         e2fsprogs-1.42-implicit_fortify_decl.patch
 Patch5:         e2fsprogs-1.42-ext2fsh_implicit.patch
+Patch6:         e2fsck-free-ctx-fs-not-fs-at-the-end-of-fsck.patch
+Patch7:         e2fsck-fix-free-pointer-dereferences.patch
+
 # Do not suppress make commands
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
@@ -141,6 +144,8 @@ Development files for the com_err error message display library.
 %patch3 -p1
 %patch4
 %patch5
+%patch6 -p1
+%patch7 -p1
 cp %{SOURCE2} .
 
 %build