ext4: CVE-2018-1094

ext4: always initialize the crc32c checksum driver

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2018-1094
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=26dbb30c58ffb85bc015bd5e58831483d50f7d18

Change-Id: I0acd7b471992aaecfa43c1d94d62aa2a6ad8a3b6
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

1 files changed, 57 insertions, 0 deletions

diff --git a/patches/cve/CVE-2018-1094-ext4-always-initialize-the-crc32c-checksum-driver.patch b/patches/cve/CVE-2018-1094-ext4-always-initialize-the-crc32c-checksum-driver.patch
new file mode 100644
index 0000000..603ac55
--- /dev/null
+++ b/patches/cve/CVE-2018-1094-ext4-always-initialize-the-crc32c-checksum-driver.patch
@@ -0,0 +1,57 @@
+From 26dbb30c58ffb85bc015bd5e58831483d50f7d18 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Thu, 29 Mar 2018 22:10:31 -0400
+Subject: [PATCH] ext4: always initialize the crc32c checksum driver
+
+commit a45403b51582a87872927a3e0fc0a389c26867f1 upstream.
+
+The extended attribute code now uses the crc32c checksum for hashing
+purposes, so we should just always always initialize it.  We also want
+to prevent NULL pointer dereferences if one of the metadata checksum
+features is enabled after the file sytsem is originally mounted.
+
+This issue has been assigned CVE-2018-1094.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=199183
+https://bugzilla.redhat.com/show_bug.cgi?id=1560788
+
+CVE: CVE-2018-1094
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=26dbb30c58ffb85bc015bd5e58831483d50f7d18]
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ fs/ext4/super.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 16d247f056e2..1339a79eb314 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3490,15 +3490,12 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+        }
+ 
+        /* Load the checksum driver */
+-       if (ext4_has_feature_metadata_csum(sb) ||
+-           ext4_has_feature_ea_inode(sb)) {
+-               sbi->s_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
+-               if (IS_ERR(sbi->s_chksum_driver)) {
+-                       ext4_msg(sb, KERN_ERR, "Cannot load crc32c driver.");
+-                       ret = PTR_ERR(sbi->s_chksum_driver);
+-                       sbi->s_chksum_driver = NULL;
+-                       goto failed_mount;
+-               }
++       sbi->s_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
++       if (IS_ERR(sbi->s_chksum_driver)) {
++               ext4_msg(sb, KERN_ERR, "Cannot load crc32c driver.");
++               ret = PTR_ERR(sbi->s_chksum_driver);
++               sbi->s_chksum_driver = NULL;
++               goto failed_mount;
+        }
+ 
+        /* Check superblock checksum */
+-- 
+2.20.1
+