Bug 460422

Summary:	kernel: ext2 does not force ro-mode when revision level is too high [rhel-4.8]
Product:	Red Hat Enterprise Linux 4	Reporter:	Eugene Teo (Security Response) <eteo>
Component:	kernel	Assignee:	Eric Sandeen <esandeen>
Status:	CLOSED WONTFIX	QA Contact:	Martin Jenner <mjenner>
Severity:	low	Docs Contact:
Priority:	medium
Version:	4.8	CC:	esandeen, lwang, security-response-team, vgoyal
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-04-01 19:57:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	460421
Bug Blocks:	461304

Description Eugene Teo (Security Response) 2008-08-28 07:41:12 UTC

+++ This bug was initially created as a clone of Bug #460421 +++

Description of problem:
The ext2 filesystem does not force read-only mode when the revision level is too high. That is, when le32_to_cpu(es->s_rev_level) > EXT3_MAX_SUPP_REV.

Comment 2 Eugene Teo (Security Response) 2008-08-28 07:43:28 UTC

 738 static int ext2_fill_super(struct super_block *sb, void *data, int silent)
 739 {
[...]
1066     ext2_setup_super (sb, es, sb->s_flags & MS_RDONLY);
1067     return 0;

 576 static int ext2_setup_super (struct super_block * sb,
 577                   struct ext2_super_block * es,
 578                   int read_only)
 579 {
 580     int res = 0;
 581     struct ext2_sb_info *sbi = EXT2_SB(sb);
 582      
 583     if (le32_to_cpu(es->s_rev_level) > EXT2_MAX_SUPP_REV) {
 584         printk ("EXT2-fs warning: revision level too high, "
 585             "forcing read-only mode\n");
 586         res = MS_RDONLY;
 587     }
[...]
 618     return res;
 619 }

It doesn't look like this piece of code is tested at all. The status returned from ext2_setup_super is not checked, so what it did was to print a warning message. I believe this should be done in the early part of ext2_fill_super().

Comment 5 RHEL Program Management 2008-09-03 13:09:55 UTC

Updating PM score.

Comment 7 RHEL Program Management 2009-03-12 18:57:34 UTC

Since RHEL 4.8 External Beta has begun, and this bugzilla remains 
unresolved, it has been rejected as it is not proposed as exception or 
blocker.

Comment 8 Eric Sandeen 2010-04-01 19:57:36 UTC

I don't think this is a critical fix for RHEL at this point.