From 59cd0ba424d3cb9a4e5ccd0af96bfec5875ac574 Mon Sep 17 00:00:00 2001 From: Andreas Wellving Date: Wed, 22 May 2019 12:10:28 +0200 Subject: btrfs: CVE-2018-14609 btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized Reference: https://nvd.nist.gov/vuln/detail/CVE-2018-14609 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=0cdbc3faf960de16ebe8a427feb3b0544ad983cc Change-Id: Idca656bc56b18fc36ec9275e232cfd058c5c7ba9 Signed-off-by: Andreas Wellving --- ...ation-Only-remove-reloc-rb_trees-if-reloc.patch | 71 ++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 patches/cve/CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch diff --git a/patches/cve/CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch b/patches/cve/CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch new file mode 100644 index 0000000..5f38a2b --- /dev/null +++ b/patches/cve/CVE-2018-14609-btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch @@ -0,0 +1,71 @@ +From 0cdbc3faf960de16ebe8a427feb3b0544ad983cc Mon Sep 17 00:00:00 2001 +From: Qu Wenruo +Date: Tue, 3 Jul 2018 17:10:07 +0800 +Subject: [PATCH] btrfs: relocation: Only remove reloc rb_trees if reloc + control has been initialized + +[ Upstream commit 389305b2aa68723c754f88d9dbd268a400e10664 ] + +Invalid reloc tree can cause kernel NULL pointer dereference when btrfs +does some cleanup of the reloc roots. + +It turns out that fs_info::reloc_ctl can be NULL in +btrfs_recover_relocation() as we allocate relocation control after all +reloc roots have been verified. +So when we hit: note, we haven't called set_reloc_control() thus +fs_info::reloc_ctl is still NULL. + +CVE: CVE-2018-14609 +Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=0cdbc3faf960de16ebe8a427feb3b0544ad983cc] + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=199833 +Reported-by: Xu Wen +Signed-off-by: Qu Wenruo +Tested-by: Gu Jinxiang +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Andreas Wellving +--- + fs/btrfs/relocation.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 9841faef08ea..b80b03e0c5d3 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1334,18 +1334,19 @@ static void __del_reloc_root(struct btrfs_root *root) + struct mapping_node *node = NULL; + struct reloc_control *rc = fs_info->reloc_ctl; + +- spin_lock(&rc->reloc_root_tree.lock); +- rb_node = tree_search(&rc->reloc_root_tree.rb_root, +- root->node->start); +- if (rb_node) { +- node = rb_entry(rb_node, struct mapping_node, rb_node); +- rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ if (rc) { ++ spin_lock(&rc->reloc_root_tree.lock); ++ rb_node = tree_search(&rc->reloc_root_tree.rb_root, ++ root->node->start); ++ if (rb_node) { ++ node = rb_entry(rb_node, struct mapping_node, rb_node); ++ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ } ++ spin_unlock(&rc->reloc_root_tree.lock); ++ if (!node) ++ return; ++ BUG_ON((struct btrfs_root *)node->data != root); + } +- spin_unlock(&rc->reloc_root_tree.lock); +- +- if (!node) +- return; +- BUG_ON((struct btrfs_root *)node->data != root); + + spin_lock(&fs_info->trans_lock); + list_del_init(&root->root_list); +-- +2.20.1 + -- cgit v1.2.3-54-g00ecf