Hide Forgot
Created attachment 1108672 [details] Bad image with big meta_bg descriptor size Package affected: e2fsprogs-1.42.9-7 Resize failed on some images which result in corrupted fs Testcase (uncompress badimage.qcow2.xz attached ) #resize2fs -p /dev/loop1 10481664k /sbin/resize2fs: Attempt to write block to filesystem resulted in short write while trying to resize /dev/loop1 Please run 'e2fsck -fy /dev/loop1' to fix the filesystem after the aborted resize operation.
This is known issue which was fixed by this commits From f66e6ce4446738c2c7f43d41988a3eb73347e2f5 Mon Sep 17 00:00:00 2001 From: Theodore Ts'o <tytso> Date: Sat, 9 Aug 2014 12:24:54 -0400 Subject: [PATCH] libext2fs: avoid buffer overflow if s_first_meta_bg is too big From 49d0fe2a14f2a23da2fe299643379b8c1d37df73 Mon Sep 17 00:00:00 2001 From: Theodore Ts'o <tytso> Date: Fri, 6 Feb 2015 12:46:39 -0500 Subject: [PATCH] libext2fs: fix potential buffer overflow in closefs() HUGE NOTE: First patch introduces buffer owerflow known as CVE-2015-1572 (https://bugzilla.redhat.com/show_bug.cgi?id=1193945) but second patch fix it. So both patches are necessery.
Hi Monakhov, I fail to reproduce by using the attached image, could you please describe steps to reproduce? log: user@host:[~/i]: md5sum bad.img.qcow2 16a727602f5557fe3a0e869fff0f4ba0 bad.img.qcow2 user@host:[~/i]: qemu-img info bad.img.qcow2 image: bad.img.qcow2 file format: qcow2 virtual size: 10T (11440717037568 bytes) disk size: 2.1M cluster_size: 4096 Format specific information: compat: 0.10 user@host:[~/i]: qemu-img convert -O raw bad.img.qcow2 bad.img.raw user@host:[~/i]: du -sh bad.img.raw 0 bad.img.raw
The bug is hard to reproduce, thus verify it by SanityOnly against e2fsprogs-1.42.9-9.el7. Regression test has been performed. Link to beaker jobs: https://url.corp.redhat.com/RHBA-2016-23887
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2454.html