From 28e754d96d3aaef7e0661a2416bad4418f2e8d9e Mon Sep 17 00:00:00 2001 From: Sona Sarmadi Date: Fri, 21 Sep 2018 10:22:04 +0200 Subject: linux-intel: Fix for CVE-2018-14609 Fix for both linux-intel and linux-intel-rt. References: https://github.com/nluedtke/linux_kernel_cves/blob/master/4.14/4.14_security.txt https://nvd.nist.gov/vuln/detail/CVE-2018-14609 Change-Id: I566e0350984df12e6a77ed68cbcd2b485b9a2713 Signed-off-by: Sona Sarmadi --- recipes-kernel/linux/linux-intel-rt_4.14.bbappend | 1 + .../linux/linux-intel/CVE-2018-14609.patch | 71 ++++++++++++++++++++++ recipes-kernel/linux/linux-intel_4.14.bbappend | 1 + 3 files changed, 73 insertions(+) create mode 100644 recipes-kernel/linux/linux-intel/CVE-2018-14609.patch diff --git a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend index b7934cf..6c4061f 100644 --- a/recipes-kernel/linux/linux-intel-rt_4.14.bbappend +++ b/recipes-kernel/linux/linux-intel-rt_4.14.bbappend @@ -13,6 +13,7 @@ SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=s file://CVE-2018-15572.patch \ file://CVE-2018-9363.patch \ file://CVE-2018-16658.patch \ + file://CVE-2018-14609.patch \ " # Debug tools support diff --git a/recipes-kernel/linux/linux-intel/CVE-2018-14609.patch b/recipes-kernel/linux/linux-intel/CVE-2018-14609.patch new file mode 100644 index 0000000..96d8a4e --- /dev/null +++ b/recipes-kernel/linux/linux-intel/CVE-2018-14609.patch @@ -0,0 +1,71 @@ +From 0cdbc3faf960de16ebe8a427feb3b0544ad983cc Mon Sep 17 00:00:00 2001 +From: Qu Wenruo +Date: Tue, 3 Jul 2018 17:10:07 +0800 +Subject: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc + control has been initialized + +[ Upstream commit 389305b2aa68723c754f88d9dbd268a400e10664 ] + +Invalid reloc tree can cause kernel NULL pointer dereference when btrfs +does some cleanup of the reloc roots. + +It turns out that fs_info::reloc_ctl can be NULL in +btrfs_recover_relocation() as we allocate relocation control after all +reloc roots have been verified. +So when we hit: note, we haven't called set_reloc_control() thus +fs_info::reloc_ctl is still NULL. + +CVE: CVE-2018-14609 +Upstream-Status: Backport + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=199833 +Reported-by: Xu Wen +Signed-off-by: Qu Wenruo +Tested-by: Gu Jinxiang +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sona Sarmadi +--- + fs/btrfs/relocation.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 9841fae..b80b03e 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1334,18 +1334,19 @@ static void __del_reloc_root(struct btrfs_root *root) + struct mapping_node *node = NULL; + struct reloc_control *rc = fs_info->reloc_ctl; + +- spin_lock(&rc->reloc_root_tree.lock); +- rb_node = tree_search(&rc->reloc_root_tree.rb_root, +- root->node->start); +- if (rb_node) { +- node = rb_entry(rb_node, struct mapping_node, rb_node); +- rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ if (rc) { ++ spin_lock(&rc->reloc_root_tree.lock); ++ rb_node = tree_search(&rc->reloc_root_tree.rb_root, ++ root->node->start); ++ if (rb_node) { ++ node = rb_entry(rb_node, struct mapping_node, rb_node); ++ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ } ++ spin_unlock(&rc->reloc_root_tree.lock); ++ if (!node) ++ return; ++ BUG_ON((struct btrfs_root *)node->data != root); + } +- spin_unlock(&rc->reloc_root_tree.lock); +- +- if (!node) +- return; +- BUG_ON((struct btrfs_root *)node->data != root); + + spin_lock(&fs_info->trans_lock); + list_del_init(&root->root_list); +-- +1.9.1 + diff --git a/recipes-kernel/linux/linux-intel_4.14.bbappend b/recipes-kernel/linux/linux-intel_4.14.bbappend index 36e0307..1fa63e0 100644 --- a/recipes-kernel/linux/linux-intel_4.14.bbappend +++ b/recipes-kernel/linux/linux-intel_4.14.bbappend @@ -7,6 +7,7 @@ SRCREV_metaenea = "8a4b6e91f12d927b3b486892c50a4ad2bcdb29d2" KENEABRANCH = "intel-4.14" SRC_URI_append = " git://git@git.enea.com/linux/enea-kernel-cache.git;protocol=ssh;type=kmeta;name=metaenea;branch=${KENEABRANCH};destsuffix=enea-kernel-meta \ file://CVE-2018-16658.patch \ + file://CVE-2018-14609.patch \ " KERNEL_FEATURES_append = " features/x2apic/x2apic.scc" -- cgit v1.2.3-54-g00ecf