diff options
author | Andreas Wellving <andreas.wellving@enea.com> | 2018-10-12 08:10:15 +0200 |
---|---|---|
committer | Adrian Dudau <Adrian.Dudau@enea.com> | 2018-10-12 14:08:27 +0200 |
commit | 114f0c3a79127252b0c11f2c9004388a8b89c07d (patch) | |
tree | d5e19b889e512428ad6d5e386f6a08af37e715b1 | |
parent | 881dab83a4597d7c0e7ca75ccee3d8038ac1b31d (diff) | |
download | enea-kernel-cache-114f0c3a79127252b0c11f2c9004388a8b89c07d.tar.gz |
btrfs: CVE-2018-14609
btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized
References:
https://patchwork.kernel.org/patch/10500521/
Change-Id: Ia40f64a8248f2062c6feeae5238b43f537bd23b5
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
-rw-r--r-- | patches/cve/4.9.x.scc | 3 | ||||
-rw-r--r-- | patches/cve/CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch | 67 |
2 files changed, 70 insertions, 0 deletions
diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc index eef4955..d730f9d 100644 --- a/patches/cve/4.9.x.scc +++ b/patches/cve/4.9.x.scc | |||
@@ -12,3 +12,6 @@ patch CVE-2018-9363-Bluetooth-hidp-buffer-overflow-in-hidp_process_repor.patch | |||
12 | 12 | ||
13 | #CVEs fixed in 4.9.125: | 13 | #CVEs fixed in 4.9.125: |
14 | patch CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch | 14 | patch CVE-2018-10938-Cipso-cipso_v4_optptr-enter-infinite-loop.patch |
15 | |||
16 | #CVEs fixed in 4.9.127: | ||
17 | patch CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch \ No newline at end of file | ||
diff --git a/patches/cve/CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch b/patches/cve/CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch new file mode 100644 index 0000000..44bf010 --- /dev/null +++ b/patches/cve/CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch | |||
@@ -0,0 +1,67 @@ | |||
1 | From 389305b2aa68723c754f88d9dbd268a400e10664 Mon Sep 17 00:00:00 2001 | ||
2 | From: Qu Wenruo <wqu@suse.com> | ||
3 | Date: Tue, 3 Jul 2018 17:10:07 +0800 | ||
4 | Subject: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc | ||
5 | control has been initialized | ||
6 | |||
7 | Invalid reloc tree can cause kernel NULL pointer dereference when btrfs | ||
8 | does some cleanup of the reloc roots. | ||
9 | |||
10 | It turns out that fs_info::reloc_ctl can be NULL in | ||
11 | btrfs_recover_relocation() as we allocate relocation control after all | ||
12 | reloc roots have been verified. | ||
13 | So when we hit: note, we haven't called set_reloc_control() thus | ||
14 | fs_info::reloc_ctl is still NULL. | ||
15 | |||
16 | CVE: CVE-2018-14609 | ||
17 | Upstream-Status: Backport | ||
18 | |||
19 | Link: https://bugzilla.kernel.org/show_bug.cgi?id=199833 | ||
20 | Reported-by: Xu Wen <wen.xu@gatech.edu> | ||
21 | Signed-off-by: Qu Wenruo <wqu@suse.com> | ||
22 | Tested-by: Gu Jinxiang <gujx@cn.fujitsu.com> | ||
23 | Reviewed-by: David Sterba <dsterba@suse.com> | ||
24 | Signed-off-by: David Sterba <dsterba@suse.com> | ||
25 | Signed-off-by: Andreas Wellving <andreas.wellving@enea.com> | ||
26 | --- | ||
27 | fs/btrfs/relocation.c | 23 ++++++++++++----------- | ||
28 | 1 file changed, 12 insertions(+), 11 deletions(-) | ||
29 | |||
30 | diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c | ||
31 | index 229f721..b98d7a5 100644 | ||
32 | --- a/fs/btrfs/relocation.c | ||
33 | +++ b/fs/btrfs/relocation.c | ||
34 | @@ -1281,18 +1281,19 @@ static void __del_reloc_root(struct btrfs_root *root) | ||
35 | struct mapping_node *node = NULL; | ||
36 | struct reloc_control *rc = fs_info->reloc_ctl; | ||
37 | |||
38 | - spin_lock(&rc->reloc_root_tree.lock); | ||
39 | - rb_node = tree_search(&rc->reloc_root_tree.rb_root, | ||
40 | - root->node->start); | ||
41 | - if (rb_node) { | ||
42 | - node = rb_entry(rb_node, struct mapping_node, rb_node); | ||
43 | - rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); | ||
44 | + if (rc) { | ||
45 | + spin_lock(&rc->reloc_root_tree.lock); | ||
46 | + rb_node = tree_search(&rc->reloc_root_tree.rb_root, | ||
47 | + root->node->start); | ||
48 | + if (rb_node) { | ||
49 | + node = rb_entry(rb_node, struct mapping_node, rb_node); | ||
50 | + rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); | ||
51 | + } | ||
52 | + spin_unlock(&rc->reloc_root_tree.lock); | ||
53 | + if (!node) | ||
54 | + return; | ||
55 | + BUG_ON((struct btrfs_root *)node->data != root); | ||
56 | } | ||
57 | - spin_unlock(&rc->reloc_root_tree.lock); | ||
58 | - | ||
59 | - if (!node) | ||
60 | - return; | ||
61 | - BUG_ON((struct btrfs_root *)node->data != root); | ||
62 | |||
63 | spin_lock(&fs_info->trans_lock); | ||
64 | list_del_init(&root->root_list); | ||
65 | -- | ||
66 | 2.7.4 | ||
67 | |||