diff --git a/debian/changelog b/debian/changelog
index 0dd1b27f5..52606e421 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -12,6 +12,8 @@ linux (4.18.6-2) UNRELEASED; urgency=medium
   [ Salvatore Bonaccorso ]
   * mac80211: don't update the PM state of a peer upon a multicast frame
     (Closes: #887045, #886292)
+  * btrfs: relocation: Only remove reloc rb_trees if reloc control has been
+    initialized (CVE-2018-14609)
 
  -- Ben Hutchings <ben@decadent.org.uk>  Sat, 08 Sep 2018 23:24:31 +0100
 
diff --git a/debian/patches/bugfix/all/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch b/debian/patches/bugfix/all/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch
new file mode 100644
index 000000000..b9a8c2556
--- /dev/null
+++ b/debian/patches/bugfix/all/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch
@@ -0,0 +1,64 @@
+From: Qu Wenruo <wqu@suse.com>
+Date: Tue, 3 Jul 2018 17:10:07 +0800
+Subject: btrfs: relocation: Only remove reloc rb_trees if reloc control has
+ been initialized
+Origin: https://git.kernel.org/linus/389305b2aa68723c754f88d9dbd268a400e10664
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-14609
+
+Invalid reloc tree can cause kernel NULL pointer dereference when btrfs
+does some cleanup of the reloc roots.
+
+It turns out that fs_info::reloc_ctl can be NULL in
+btrfs_recover_relocation() as we allocate relocation control after all
+reloc roots have been verified.
+So when we hit: note, we haven't called set_reloc_control() thus
+fs_info::reloc_ctl is still NULL.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=199833
+Reported-by: Xu Wen <wen.xu@gatech.edu>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Tested-by: Gu Jinxiang <gujx@cn.fujitsu.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/relocation.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 229f721cbde9..b98d7a594542 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1281,18 +1281,19 @@ static void __del_reloc_root(struct btrfs_root *root)
+ 	struct mapping_node *node = NULL;
+ 	struct reloc_control *rc = fs_info->reloc_ctl;
+ 
+-	spin_lock(&rc->reloc_root_tree.lock);
+-	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+-			      root->node->start);
+-	if (rb_node) {
+-		node = rb_entry(rb_node, struct mapping_node, rb_node);
+-		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++	if (rc) {
++		spin_lock(&rc->reloc_root_tree.lock);
++		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
++				      root->node->start);
++		if (rb_node) {
++			node = rb_entry(rb_node, struct mapping_node, rb_node);
++			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++		}
++		spin_unlock(&rc->reloc_root_tree.lock);
++		if (!node)
++			return;
++		BUG_ON((struct btrfs_root *)node->data != root);
+ 	}
+-	spin_unlock(&rc->reloc_root_tree.lock);
+-
+-	if (!node)
+-		return;
+-	BUG_ON((struct btrfs_root *)node->data != root);
+ 
+ 	spin_lock(&fs_info->trans_lock);
+ 	list_del_init(&root->root_list);
+-- 
+2.19.0
+
diff --git a/debian/patches/series b/debian/patches/series
index 83c850288..d87552e92 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -143,6 +143,7 @@ features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch
 # Security fixes
 debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
 bugfix/all/Revert-net-increase-fragment-memory-usage-limits.patch
+bugfix/all/btrfs-relocation-Only-remove-reloc-rb_trees-if-reloc.patch
 
 # Fix exported symbol versions
 bugfix/all/module-disable-matching-missing-version-crc.patch