btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized (CVE-2018-14609)
This commit is contained in:
parent
0343988a9a
commit
f84af2d0a0
|
@ -12,6 +12,8 @@ linux (4.18.6-2) UNRELEASED; urgency=medium
|
|||
[ Salvatore Bonaccorso ]
|
||||
* mac80211: don't update the PM state of a peer upon a multicast frame
|
||||
(Closes: #887045, #886292)
|
||||
* btrfs: relocation: Only remove reloc rb_trees if reloc control has been
|
||||
initialized (CVE-2018-14609)
|
||||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Sat, 08 Sep 2018 23:24:31 +0100
|
||||
|
||||
|
|
64
debian/patches/bugfix/all/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch
vendored
Normal file
64
debian/patches/bugfix/all/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch
vendored
Normal file
|
@ -0,0 +1,64 @@
|
|||
From: Qu Wenruo <wqu@suse.com>
|
||||
Date: Tue, 3 Jul 2018 17:10:07 +0800
|
||||
Subject: btrfs: relocation: Only remove reloc rb_trees if reloc control has
|
||||
been initialized
|
||||
Origin: https://git.kernel.org/linus/389305b2aa68723c754f88d9dbd268a400e10664
|
||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-14609
|
||||
|
||||
Invalid reloc tree can cause kernel NULL pointer dereference when btrfs
|
||||
does some cleanup of the reloc roots.
|
||||
|
||||
It turns out that fs_info::reloc_ctl can be NULL in
|
||||
btrfs_recover_relocation() as we allocate relocation control after all
|
||||
reloc roots have been verified.
|
||||
So when we hit: note, we haven't called set_reloc_control() thus
|
||||
fs_info::reloc_ctl is still NULL.
|
||||
|
||||
Link: https://bugzilla.kernel.org/show_bug.cgi?id=199833
|
||||
Reported-by: Xu Wen <wen.xu@gatech.edu>
|
||||
Signed-off-by: Qu Wenruo <wqu@suse.com>
|
||||
Tested-by: Gu Jinxiang <gujx@cn.fujitsu.com>
|
||||
Reviewed-by: David Sterba <dsterba@suse.com>
|
||||
Signed-off-by: David Sterba <dsterba@suse.com>
|
||||
---
|
||||
fs/btrfs/relocation.c | 23 ++++++++++++-----------
|
||||
1 file changed, 12 insertions(+), 11 deletions(-)
|
||||
|
||||
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
|
||||
index 229f721cbde9..b98d7a594542 100644
|
||||
--- a/fs/btrfs/relocation.c
|
||||
+++ b/fs/btrfs/relocation.c
|
||||
@@ -1281,18 +1281,19 @@ static void __del_reloc_root(struct btrfs_root *root)
|
||||
struct mapping_node *node = NULL;
|
||||
struct reloc_control *rc = fs_info->reloc_ctl;
|
||||
|
||||
- spin_lock(&rc->reloc_root_tree.lock);
|
||||
- rb_node = tree_search(&rc->reloc_root_tree.rb_root,
|
||||
- root->node->start);
|
||||
- if (rb_node) {
|
||||
- node = rb_entry(rb_node, struct mapping_node, rb_node);
|
||||
- rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
|
||||
+ if (rc) {
|
||||
+ spin_lock(&rc->reloc_root_tree.lock);
|
||||
+ rb_node = tree_search(&rc->reloc_root_tree.rb_root,
|
||||
+ root->node->start);
|
||||
+ if (rb_node) {
|
||||
+ node = rb_entry(rb_node, struct mapping_node, rb_node);
|
||||
+ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
|
||||
+ }
|
||||
+ spin_unlock(&rc->reloc_root_tree.lock);
|
||||
+ if (!node)
|
||||
+ return;
|
||||
+ BUG_ON((struct btrfs_root *)node->data != root);
|
||||
}
|
||||
- spin_unlock(&rc->reloc_root_tree.lock);
|
||||
-
|
||||
- if (!node)
|
||||
- return;
|
||||
- BUG_ON((struct btrfs_root *)node->data != root);
|
||||
|
||||
spin_lock(&fs_info->trans_lock);
|
||||
list_del_init(&root->root_list);
|
||||
--
|
||||
2.19.0
|
||||
|
|
@ -143,6 +143,7 @@ features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch
|
|||
# Security fixes
|
||||
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
|
||||
bugfix/all/Revert-net-increase-fragment-memory-usage-limits.patch
|
||||
bugfix/all/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch
|
||||
|
||||
# Fix exported symbol versions
|
||||
bugfix/all/module-disable-matching-missing-version-crc.patch
|
||||
|
|
Loading…
Reference in New Issue