3.18-stable patches

added patches:
	cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch

diff --git a/queue-3.18/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch b/queue-3.18/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch
new file mode 100644 (file)
index 0000000..6640fe4
--- /dev/null
+++ b/queue-3.18/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch
@@ -0,0 +1,34 @@
+From 672ca9dd13f1aca0c17516f76fc5b0e8344b3e46 Mon Sep 17 00:00:00 2001
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+Date: Tue, 30 Oct 2018 13:26:15 -0400
+Subject: Cramfs: fix abad comparison when wrap-arounds occur
+
+From: Nicolas Pitre <nicolas.pitre@linaro.org>
+
+commit 672ca9dd13f1aca0c17516f76fc5b0e8344b3e46 upstream.
+
+It is possible for corrupted filesystem images to produce very large
+block offsets that may wrap when a length is added, and wrongly pass
+the buffer size test.
+
+Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
+Signed-off-by: Nicolas Pitre <nico@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cramfs/inode.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -185,7 +185,8 @@ static void *cramfs_read(struct super_bl
+                       continue;
+               blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_CACHE_SHIFT;
+               blk_offset += offset;
+-              if (blk_offset + len > BUFFER_SIZE)
++              if (blk_offset > BUFFER_SIZE ||
++                  blk_offset + len > BUFFER_SIZE)
+                       continue;
+               return read_buffers[i] + blk_offset;
+       }

diff --git a/queue-3.18/series b/queue-3.18/series
index 2e13fa805afb0d03860174d23a92fa8bbb18d82f..0e01a12b3d31c373dbebb3d26f6c3b22fa2c0722 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -52,3 +52,4 @@ kgdboc-passing-ekgdboc-to-command-line-causes-panic.patch
 media-em28xx-use-a-default-format-if-try_fmt-fails.patch
 media-em28xx-fix-input-name-for-terratec-av-350.patch
 media-em28xx-make-v4l2-compliance-happier-by-starting-sequence-on-zero.patch
+cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch