3.18-stable patches

added patches:
	ubifs-check-for-name-being-null-while-mounting.patch

diff --git a/queue-3.18/series b/queue-3.18/series
index 2f8b42e50305b40080aa5715e6a10301808cff0a..c3444944f1ed3a56c6bae00fdb894ee11dba7b04 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -116,3 +116,4 @@ ext4-add-more-inode-number-paranoia-checks.patch
 jbd2-don-t-mark-block-as-modified-if-the-handle-is-out-of-credits.patch
 ext4-avoid-running-out-of-journal-credits-when-appending-to-an-inline-file.patch
 cgroup-fix-deadlock-in-cpu-hotplug-path.patch
+ubifs-check-for-name-being-null-while-mounting.patch

diff --git a/queue-3.18/ubifs-check-for-name-being-null-while-mounting.patch b/queue-3.18/ubifs-check-for-name-being-null-while-mounting.patch
new file mode 100644 (file)
index 0000000..8187cee
--- /dev/null
+++ b/queue-3.18/ubifs-check-for-name-being-null-while-mounting.patch
@@ -0,0 +1,34 @@
+From 37f31b6ca4311b94d985fb398a72e5399ad57925 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Mon, 3 Sep 2018 23:06:23 +0200
+Subject: ubifs: Check for name being NULL while mounting
+
+From: Richard Weinberger <richard@nod.at>
+
+commit 37f31b6ca4311b94d985fb398a72e5399ad57925 upstream.
+
+The requested device name can be NULL or an empty string.
+Check for that and refuse to continue. UBIFS has to do this manually
+since we cannot use mount_bdev(), which checks for this condition.
+
+Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system")
+Reported-by: syzbot+38bd0f7865e5c6379280@syzkaller.appspotmail.com
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/super.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1917,6 +1917,9 @@ static struct ubi_volume_desc *open_ubi(
+       int dev, vol;
+       char *endptr;
+ 
++      if (!name || !*name)
++              return ERR_PTR(-EINVAL);
++
+       /* First, try to open using the device node path method */
+       ubi = ubi_open_volume_path(name, mode);
+       if (!IS_ERR(ubi))