diff options
Diffstat (limited to 'recipes-kernel/linux/linux-intel')
-rw-r--r-- | recipes-kernel/linux/linux-intel/CVE-2018-13094.patch | 51 |
1 files changed, 51 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-intel/CVE-2018-13094.patch b/recipes-kernel/linux/linux-intel/CVE-2018-13094.patch new file mode 100644 index 0000000..b42ac8f --- /dev/null +++ b/recipes-kernel/linux/linux-intel/CVE-2018-13094.patch | |||
@@ -0,0 +1,51 @@ | |||
1 | From 59f35b983e8aeb98188c6ef93f8eabc594f8f953 Mon Sep 17 00:00:00 2001 | ||
2 | From: Eric Sandeen <sandeen@sandeen.net> | ||
3 | Date: Fri, 8 Jun 2018 09:53:49 -0700 | ||
4 | Subject: [PATCH] xfs: don't call xfs_da_shrink_inode with NULL bp | ||
5 | |||
6 | commit bb3d48dcf86a97dc25fe9fc2c11938e19cb4399a upstream. | ||
7 | |||
8 | xfs_attr3_leaf_create may have errored out before instantiating a buffer, | ||
9 | for example if the blkno is out of range. In that case there is no work | ||
10 | to do to remove it, and in fact xfs_da_shrink_inode will lead to an oops | ||
11 | if we try. | ||
12 | |||
13 | This also seems to fix a flaw where the original error from | ||
14 | xfs_attr3_leaf_create gets overwritten in the cleanup case, and it | ||
15 | removes a pointless assignment to bp which isn't used after this. | ||
16 | |||
17 | CVE: CVE-2018-13094 | ||
18 | Upstream-Status: Backport | ||
19 | |||
20 | Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199969 | ||
21 | Reported-by: Xu, Wen <wen.xu@gatech.edu> | ||
22 | Tested-by: Xu, Wen <wen.xu@gatech.edu> | ||
23 | Signed-off-by: Eric Sandeen <sandeen@redhat.com> | ||
24 | Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> | ||
25 | Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> | ||
26 | Cc: Eduardo Valentin <eduval@amazon.com> | ||
27 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
28 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
29 | --- | ||
30 | fs/xfs/libxfs/xfs_attr_leaf.c | 5 ++--- | ||
31 | 1 file changed, 2 insertions(+), 3 deletions(-) | ||
32 | |||
33 | diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c | ||
34 | index 5c16db8..40e53a4 100644 | ||
35 | --- a/fs/xfs/libxfs/xfs_attr_leaf.c | ||
36 | +++ b/fs/xfs/libxfs/xfs_attr_leaf.c | ||
37 | @@ -785,9 +785,8 @@ STATIC void xfs_attr3_leaf_moveents(struct xfs_da_args *args, | ||
38 | ASSERT(blkno == 0); | ||
39 | error = xfs_attr3_leaf_create(args, blkno, &bp); | ||
40 | if (error) { | ||
41 | - error = xfs_da_shrink_inode(args, 0, bp); | ||
42 | - bp = NULL; | ||
43 | - if (error) | ||
44 | + /* xfs_attr3_leaf_create may not have instantiated a block */ | ||
45 | + if (bp && (xfs_da_shrink_inode(args, 0, bp) != 0)) | ||
46 | goto out; | ||
47 | xfs_idata_realloc(dp, size, XFS_ATTR_FORK); /* try to put */ | ||
48 | memcpy(ifp->if_u1.if_data, tmpbuffer, size); /* it back */ | ||
49 | -- | ||
50 | 1.9.1 | ||
51 | |||