1 files changed, 66 insertions, 0 deletions

diff --git a/patches/cve/CVE-2018-10878-ext4-always-check-block-group-bounds-in-ext4_init_bl.patch b/patches/cve/CVE-2018-10878-ext4-always-check-block-group-bounds-in-ext4_init_bl.patch
new file mode 100644
index 0000000..f478f61
--- /dev/null
+++ b/patches/cve/CVE-2018-10878-ext4-always-check-block-group-bounds-in-ext4_init_bl.patch
@@ -0,0 +1,66 @@
+From ac48bb9bc0a32f5a4432be1645b57607f8c46aa7 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 13 Jun 2018 23:00:48 -0400
+Subject: [PATCH] ext4: always check block group bounds in
+ ext4_init_block_bitmap()
+
+commit 819b23f1c501b17b9694325471789e6b5cc2d0d2 upstream.
+
+Regardless of whether the flex_bg feature is set, we should always
+check to make sure the bits we are setting in the block bitmap are
+within the block group bounds.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=199865
+
+CVE: CVE-2018-10878
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=ac48bb9bc0a32f5a4432be1645b57607f8c46aa7]
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ fs/ext4/balloc.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
+index 58db8109defa..3149aee77b6b 100644
+--- a/fs/ext4/balloc.c
++++ b/fs/ext4/balloc.c
+@@ -184,7 +184,6 @@ static int ext4_init_block_bitmap(struct super_block *sb,
+        unsigned int bit, bit_max;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        ext4_fsblk_t start, tmp;
+-       int flex_bg = 0;
+        struct ext4_group_info *grp;
+ 
+        J_ASSERT_BH(bh, buffer_locked(bh));
+@@ -217,22 +216,19 @@ static int ext4_init_block_bitmap(struct super_block *sb,
+ 
+        start = ext4_group_first_block_no(sb, block_group);
+ 
+-       if (ext4_has_feature_flex_bg(sb))
+-               flex_bg = 1;
+-
+        /* Set bits for block and inode bitmaps, and inode table */
+        tmp = ext4_block_bitmap(sb, gdp);
+-       if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
++       if (ext4_block_in_group(sb, tmp, block_group))
+                ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
+ 
+        tmp = ext4_inode_bitmap(sb, gdp);
+-       if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
++       if (ext4_block_in_group(sb, tmp, block_group))
+                ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
+ 
+        tmp = ext4_inode_table(sb, gdp);
+        for (; tmp < ext4_inode_table(sb, gdp) +
+                     sbi->s_itb_per_group; tmp++) {
+-               if (!flex_bg || ext4_block_in_group(sb, tmp, block_group))
++               if (ext4_block_in_group(sb, tmp, block_group))
+                        ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data);
+        }
+ 
+-- 
+2.20.1
+