Bug 460421

Summary: kernel: ext2 does not force ro-mode when revision level is too high [rhel-5.3]
Product: Red Hat Enterprise Linux 5 Reporter: Eugene Teo (Security Response) <eteo>
Component: kernelAssignee: Eric Sandeen <esandeen>
Status: CLOSED WONTFIX QA Contact: Red Hat Kernel QE team <kernel-qe>
Severity: low Docs Contact:
Priority: medium    
Version: 5.3CC: dzickus, esandeen, lwang, rwheeler, security-response-team
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-04-01 15:57:15 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 460422    

Description Eugene Teo (Security Response) 2008-08-28 03:26:41 EDT
Description of problem:
The ext2 filesystem does not force read-only mode when the revision level is too high. That is, when le32_to_cpu(es->s_rev_level) > EXT3_MAX_SUPP_REV.
Comment 2 Eugene Teo (Security Response) 2008-08-28 03:31:59 EDT
 738 static int ext2_fill_super(struct super_block *sb, void *data, int silent)
 739 {
[...]
1066     ext2_setup_super (sb, es, sb->s_flags & MS_RDONLY);
1067     return 0;

 576 static int ext2_setup_super (struct super_block * sb,
 577                   struct ext2_super_block * es,
 578                   int read_only)
 579 {
 580     int res = 0;
 581     struct ext2_sb_info *sbi = EXT2_SB(sb);
 582      
 583     if (le32_to_cpu(es->s_rev_level) > EXT2_MAX_SUPP_REV) {
 584         printk ("EXT2-fs warning: revision level too high, "
 585             "forcing read-only mode\n");
 586         res = MS_RDONLY;
 587     }
[...]
 618     return res;
 619 }

It doesn't look like this piece of code is tested at all. The status returned from ext2_setup_super is not checked at all, so what it did was to print a warning message. I believe this should be done in the early part of ext2_fill_super().
Comment 10 RHEL Product and Program Management 2009-02-16 10:34:22 EST
Updating PM score.
Comment 12 Eric Sandeen 2010-04-01 15:57:15 EDT
I don't think this is a critical fix for RHEL at this point.