linux-intel: Fix for CVE-2018-14609

Fix for both linux-intel and linux-intel-rt.

References:
https://github.com/nluedtke/linux_kernel_cves/blob/master/4.14/4.14_security.txt
https://nvd.nist.gov/vuln/detail/CVE-2018-14609

Change-Id: I566e0350984df12e6a77ed68cbcd2b485b9a2713
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>

3 files changed, 73 insertions, 0 deletions

diff --git a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend
index b7934cf..6c4061f 100644
--- a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend
+++ b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend
@@ -13,6 +13,7 @@ SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=s
                    file://CVE-2018-15572.patch \
                    file://CVE-2018-9363.patch \
                    file://CVE-2018-16658.patch \
+                   file://CVE-2018-14609.patch \
                  "
 
 # Debug tools support
diff --git a/recipes-kernel/linux/linux-intel/CVE-2018-14609.patch b/recipes-kernel/linux/linux-intel/CVE-2018-14609.patch
new file mode 100644
index 0000000..96d8a4e
--- /dev/null
+++ b/recipes-kernel/linux/linux-intel/CVE-2018-14609.patch
@@ -0,0 +1,71 @@
+From 0cdbc3faf960de16ebe8a427feb3b0544ad983cc Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Tue, 3 Jul 2018 17:10:07 +0800
+Subject: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc
+ control has been initialized
+
+[ Upstream commit 389305b2aa68723c754f88d9dbd268a400e10664 ]
+
+Invalid reloc tree can cause kernel NULL pointer dereference when btrfs
+does some cleanup of the reloc roots.
+
+It turns out that fs_info::reloc_ctl can be NULL in
+btrfs_recover_relocation() as we allocate relocation control after all
+reloc roots have been verified.
+So when we hit: note, we haven't called set_reloc_control() thus
+fs_info::reloc_ctl is still NULL.
+
+CVE: CVE-2018-14609
+Upstream-Status: Backport
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=199833
+Reported-by: Xu Wen <wen.xu@gatech.edu>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Tested-by: Gu Jinxiang <gujx@cn.fujitsu.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
+---
+ fs/btrfs/relocation.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 9841fae..b80b03e 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1334,18 +1334,19 @@ static void __del_reloc_root(struct btrfs_root *root)
+        struct mapping_node *node = NULL;
+        struct reloc_control *rc = fs_info->reloc_ctl;
+ 
+-       spin_lock(&rc->reloc_root_tree.lock);
+-       rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+-                             root->node->start);
+-       if (rb_node) {
+-               node = rb_entry(rb_node, struct mapping_node, rb_node);
+-               rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++       if (rc) {
++               spin_lock(&rc->reloc_root_tree.lock);
++               rb_node = tree_search(&rc->reloc_root_tree.rb_root,
++                                     root->node->start);
++               if (rb_node) {
++                       node = rb_entry(rb_node, struct mapping_node, rb_node);
++                       rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++               }
++               spin_unlock(&rc->reloc_root_tree.lock);
++               if (!node)
++                       return;
++               BUG_ON((struct btrfs_root *)node->data != root);
+        }
+-       spin_unlock(&rc->reloc_root_tree.lock);
+-
+-       if (!node)
+-               return;
+-       BUG_ON((struct btrfs_root *)node->data != root);
+ 
+        spin_lock(&fs_info->trans_lock);
+        list_del_init(&root->root_list);
+-- 
+1.9.1
+
diff --git a/recipes-kernel/linux/linux-intel_4.14.bbappend b/recipes-kernel/linux/linux-intel_4.14.bbappend
index 36e0307..1fa63e0 100644
--- a/recipes-kernel/linux/linux-intel_4.14.bbappend
+++ b/recipes-kernel/linux/linux-intel_4.14.bbappend
@@ -7,6 +7,7 @@ SRCREV_metaenea = "8a4b6e91f12d927b3b486892c50a4ad2bcdb29d2"
 KENEABRANCH = "intel-4.14"
 SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-meta \
                    file://CVE-2018-16658.patch \
+                   file://CVE-2018-14609.patch \
                  "
 
 KERNEL_FEATURES_append = " features/x2apic/x2apic.scc"