ext4: CVE-2018-10876

ext4: only look at the bg_flags field if it is valid

References:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8844618d8aa7a9973e7b527d038a2a589665002c

Change-Id: If6d5ecfd74acafe75c6e6f4919f44127cfc7baa7
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 138 insertions, 0 deletions

diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc
index f7429aa..959c87b 100644
--- a/patches/cve/4.9.x.scc
+++ b/patches/cve/4.9.x.scc
@@ -25,3 +25,6 @@ patch CVE-2017-18255-perf-core-Fix-the-perf_cpu_time_max_percent-check.patch
 
 #CVEs fixed in 4.9.104:
 patch CVE-2018-9518-NFC-llcp-Limit-size-of-SDP-URI.patch
+
+#CVEs fixed in 4.9.112:
+patch CVE-2018-10876-ext4-only-look-at-the-bg_flags-field-if-it-is-valid.patch
diff --git a/patches/cve/CVE-2018-10876-ext4-only-look-at-the-bg_flags-field-if-it-is-valid.patch b/patches/cve/CVE-2018-10876-ext4-only-look-at-the-bg_flags-field-if-it-is-valid.patch
new file mode 100644
index 0000000..fe172e6
--- /dev/null
+++ b/patches/cve/CVE-2018-10876-ext4-only-look-at-the-bg_flags-field-if-it-is-valid.patch
@@ -0,0 +1,135 @@
+Date: Fri, 12 Oct 2018 13:56:16 +0200
+Subject: [PATCH] ext4: only look at the bg_flags field if it is valid The
+ bg_flags field in the block group descripts is only valid if the uninit_bg or
+ metadata_csum feature is enabled.  We were not consistently looking at this
+ field; fix this.
+
+Also block group #0 must never have uninitialized allocation bitmaps,
+or need to be zeroed, since that's where the root inode, and other
+special inodes are set up.  Check for these conditions and mark the
+file system as corrupted if they are detected.
+
+This addresses CVE-2018-10876.
+Upstream-Status: Backport
+
+https://bugzilla.kernel.org/show_bug.cgi?id=199403
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ fs/ext4/balloc.c  | 11 ++++++++++-
+ fs/ext4/ialloc.c  | 14 ++++++++++++--
+ fs/ext4/mballoc.c |  6 ++++--
+ fs/ext4/super.c   | 11 ++++++++++-
+ 4 files changed, 36 insertions(+), 6 deletions(-)
+
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index e04ec86..10e18f7 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -443,7 +443,16 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group)
+                goto verify;
+        }
+        ext4_lock_group(sb, block_group);
+-       if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
++       if (ext4_has_group_desc_csum(sb) &&
++           (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
++               if (block_group == 0) {
++                       ext4_unlock_group(sb, block_group);
++                       unlock_buffer(bh);
++                       ext4_error(sb, "Block bitmap for bg 0 marked "
++                                  "uninitialized");
++                       err = -EFSCORRUPTED;
++                       goto out;
++               }
+                err = ext4_init_block_bitmap(sb, bh, block_group, desc);
+                set_bitmap_uptodate(bh);
+                set_buffer_uptodate(bh);
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 2d94e85..e937aad 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -183,7 +183,16 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
+        }
+ 
+        ext4_lock_group(sb, block_group);
+-       if (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)) {
++       if (ext4_has_group_desc_csum(sb) &&
++           (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT))) {
++               if (block_group == 0) {
++                       ext4_unlock_group(sb, block_group);
++                       unlock_buffer(bh);
++                       ext4_error(sb, "Inode bitmap for bg 0 marked "
++                                  "uninitialized");
++                       err = -EFSCORRUPTED;
++                       goto out;
++               }
+                err = ext4_init_inode_bitmap(sb, bh, block_group, desc);
+                set_bitmap_uptodate(bh);
+                set_buffer_uptodate(bh);
+@@ -960,7 +969,8 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir,
+ 
+                /* recheck and clear flag under lock if we still need to */
+                ext4_lock_group(sb, group);
+-               if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
++               if (ext4_has_group_desc_csum(sb) &&
++                   (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
+                        gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT);
+                        ext4_free_group_clusters_set(sb, gdp,
+                                ext4_free_clusters_after_init(sb, group, gdp));
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 64056c6..4869946 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -2444,7 +2444,8 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group,
+         * initialize bb_free to be able to skip
+         * empty groups without initialization
+         */
+-       if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
++       if (ext4_has_group_desc_csum(sb) &&
++           (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
+                meta_group_info[i]->bb_free =
+                        ext4_free_clusters_after_init(sb, group, desc);
+        } else {
+@@ -2969,7 +2970,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
+ #endif
+        ext4_set_bits(bitmap_bh->b_data, ac->ac_b_ex.fe_start,
+                      ac->ac_b_ex.fe_len);
+-       if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) {
++       if (ext4_has_group_desc_csum(sb) &&
++           (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) {
+                gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT);
+                ext4_free_group_clusters_set(sb, gdp,
+                                             ext4_free_clusters_after_init(sb,
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 1f58179..97d322b 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2991,13 +2991,22 @@ static ext4_group_t ext4_has_uninit_itable(struct super_block *sb)
+        ext4_group_t group, ngroups = EXT4_SB(sb)->s_groups_count;
+        struct ext4_group_desc *gdp = NULL;
+ 
++       if (!ext4_has_group_desc_csum(sb))
++               return ngroups;
++
+        for (group = 0; group < ngroups; group++) {
+                gdp = ext4_get_group_desc(sb, group, NULL);
+                if (!gdp)
+                        continue;
+ 
+-               if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)))
++               if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))
++                       continue;
++               if (group != 0)
+                        break;
++               ext4_error(sb, "Inode table for bg 0 marked as "
++                          "needing zeroing");
++               if (sb_rdonly(sb))
++                       return ngroups;
+        }
+ 
+        return group;
+-- 
+
+