linux-ext4 - Re: [PATCH 1/2] mke2fs: fix project quota creation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160523004954.GE6720@thunk.org>
Date:	Sun, 22 May 2016 20:49:54 -0400
From:	Theodore Ts'o <tytso@....edu>
To:	Wang Shilong <wangshilong1991@...il.com>
Cc:	Ext4 Developers List <linux-ext4@...r.kernel.org>
Subject: Re: [PATCH 1/2] mke2fs: fix project quota creation

On Sun, May 22, 2016 at 01:34:59PM +0800, Wang Shilong wrote:
> On Sun, May 22, 2016 at 10:19 AM, Theodore Ts'o <tytso@....edu> wrote:
> > Creating a file system with project quotas can fail if mke2fs is built
> > using hardening options.  This is because quota_compute_usage() used
> > ext2fs_get_next_inode() instead of ext2fs_get_inode_full(), and a
> > small inode was passed into quota_data_add, when a large inode needs
> > to be used.  As a result get_dq() would end up dereferencing undefined
> > space in the stack.  Without the hardening options, this would be
> > zero, so "mke2fs -t ext4 -O project.quota -I 256 test.img" would work
> > essentially by accident.
> >
> > Fix this by using ext2fs_get_inode_full() so that a large inode is
> > available to quota_data_inodes().
> >
> > Signed-off-by: Theodore Ts'o <tytso@....edu>
> 
> I thought Li Xi sent updated e2fsprogs including this fixing parts.
> maybe because you merged early version patches.

There was a separate patch that broke ABI backwards compatibility of
e2fsprogs' shared libraries, which I rejected on those grounds,
perhaps that's what you thinking of?  It wasn't clear that the patch
was in fact fixing a problem, as opposed to just being a clean up.  So
I didn't realize there was a problem that needed fixing.

  	 	       	     	     	  - Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html