linux-ext4 - [PATCH 03/19] libext2fs: fix ext2fs_mmp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <176246793681.2862242.7001143370190940389.stgit@frogsfrogsfrogs>
Date: Thu, 06 Nov 2025 14:31:52 -0800
From: "Darrick J. Wong" <djwong@...nel.org>
To: tytso@....edu
Cc: linux-ext4@...r.kernel.org, linux-ext4@...r.kernel.org
Subject: [PATCH 03/19] libext2fs: fix ext2fs_mmp_update

From: Darrick J. Wong <djwong@...nel.org>

ext2fs_mmp_read has this undocumented behavior that it updates
fs->mmp_cmp and not fs->mmp_buf.  Therefore, ext2fs_mmp_update2 actually
updates a stale version of the MMP buffer and writes that out to disk.
Fortunately the only two fields that get updated regularly mmp_time and
mmp_seq so the behavior was never incorrect, but this confused me for a
while, so let's fix it.

Cc: <linux-ext4@...r.kernel.org> # v1.42
Fixes: 0f5eba7501f467 ("ext2fs: add multi-mount protection (INCOMPAT_MMP)")
Signed-off-by: "Darrick J. Wong" <djwong@...nel.org>
---
 lib/ext2fs/mmp.c |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/ext2fs/mmp.c b/lib/ext2fs/mmp.c
index eb9417020e6d3f..6337852c3f6700 100644
--- a/lib/ext2fs/mmp.c
+++ b/lib/ext2fs/mmp.c
@@ -469,6 +469,12 @@ errcode_t ext2fs_mmp_update2(ext2_filsys fs, int immediately)
 	if (memcmp(mmp, mmp_cmp, sizeof(*mmp_cmp)))
 		return EXT2_ET_MMP_CHANGE_ABORT;

+	/*
+	 * Believe it or not, ext2fs_mmp_read actually overwrites fs->mmp_cmp
+	 * and leaves fs->mmp_buf untouched.  Hence we copy mmp_cmp into
+	 * mmp_buf, update mmp_buf, and write mmp_buf out to disk.
+	 */
+	memcpy(mmp, mmp_cmp, sizeof(*mmp_cmp));
 	mmp->mmp_time = tv.tv_sec;
 	mmp->mmp_seq = EXT4_MMP_SEQ_FSCK;
 	retval = ext2fs_mmp_write(fs, fs->super->s_mmp_block, fs->mmp_buf);