ext4: CVE-2018-10879

ext4: make sure bitmaps and the inode table don't overlap with bg descriptors

References:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5369a762c882c0b6e9599e4ebbb3a9ba9eee7e2d

Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

Change-Id: I6b3e2539d53ec7021ecd4ff4055cf66e42a5248a

2 files changed, 84 insertions, 0 deletions

diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc
index 08429b4..e5bf4ac 100644
--- a/patches/cve/4.9.x.scc
+++ b/patches/cve/4.9.x.scc
@@ -30,4 +30,5 @@ patch CVE-2018-9518-NFC-llcp-Limit-size-of-SDP-URI.patch
 patch CVE-2018-10876-ext4-only-look-at-the-bg_flags-field-if-it-is-valid.patch
 patch CVE-2018-10877-ext4-verify-the-depth-of-extent-tree-in-ext4_find_ex.patch
 patch CVE-2018-10878-ext4-always-check-block-group-bounds-in-ext4_init_bl.patch
+patch CVE-2018-10879-ext4-make-sure-bitmaps-and-the-inode-table-don-t-ove.patch
 
diff --git a/patches/cve/CVE-2018-10879-ext4-make-sure-bitmaps-and-the-inode-table-don-t-ove.patch b/patches/cve/CVE-2018-10879-ext4-make-sure-bitmaps-and-the-inode-table-don-t-ove.patch
new file mode 100644
index 0000000..439c9e9
--- /dev/null
+++ b/patches/cve/CVE-2018-10879-ext4-make-sure-bitmaps-and-the-inode-table-don-t-ove.patch
@@ -0,0 +1,83 @@
+From 77260807d1170a8cf35dbb06e07461a655f67eee Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 13 Jun 2018 23:08:26 -0400
+Subject: [PATCH] ext4: make sure bitmaps and the inode table don't overlap
+ with bg descriptors
+
+It's really bad when the allocation bitmaps and the inode table
+overlap with the block group descriptors, since it causes random
+corruption of the bg descriptors.  So we really want to head those off
+at the pass.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=199865
+
+CVE: CVE-2018-10879   
+Upstream-Status: Backport  
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ fs/ext4/super.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index c8b7b83..c61675d 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2348,6 +2348,7 @@ static int ext4_check_descriptors(struct super_block *sb,
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
+        ext4_fsblk_t last_block;
++       ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1;
+        ext4_fsblk_t block_bitmap;
+        ext4_fsblk_t inode_bitmap;
+        ext4_fsblk_t inode_table;
+@@ -2380,6 +2381,14 @@ static int ext4_check_descriptors(struct super_block *sb,
+                        if (!sb_rdonly(sb))
+                                return 0;
+                }
++               if (block_bitmap >= sb_block + 1 &&
++                   block_bitmap <= last_bg_block) {
++                       ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++                                "Block bitmap for group %u overlaps "
++                                "block group descriptors", i);
++                       if (!sb_rdonly(sb))
++                               return 0;
++               }
+                if (block_bitmap < first_block || block_bitmap > last_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                               "Block bitmap for group %u not in group "
+@@ -2394,6 +2403,14 @@ static int ext4_check_descriptors(struct super_block *sb,
+                        if (!sb_rdonly(sb))
+                                return 0;
+                }
++               if (inode_bitmap >= sb_block + 1 &&
++                   inode_bitmap <= last_bg_block) {
++                       ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++                                "Inode bitmap for group %u overlaps "
++                                "block group descriptors", i);
++                       if (!sb_rdonly(sb))
++                               return 0;
++               }
+                if (inode_bitmap < first_block || inode_bitmap > last_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                               "Inode bitmap for group %u not in group "
+@@ -2408,6 +2425,14 @@ static int ext4_check_descriptors(struct super_block *sb,
+                        if (!sb_rdonly(sb))
+                                return 0;
+                }
++               if (inode_table >= sb_block + 1 &&
++                   inode_table <= last_bg_block) {
++                       ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
++                                "Inode table for group %u overlaps "
++                                "block group descriptors", i);
++                       if (!sb_rdonly(sb))
++                               return 0;
++               }
+                if (inode_table < first_block ||
+                    inode_table + sbi->s_itb_per_group - 1 > last_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+-- 
+2.7.4
+