From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 11 Oct 2018 13:33:38 +0000 (+0200)
Subject: 3.18-stable patches
X-Git-Tag: v3.18.124~16
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7895aafb45d6946e2eab410e06515c0b4544e21c;p=thirdparty%2Fkernel%2Fstable-queue.git

3.18-stable patches

added patches:
	ubifs-check-for-name-being-null-while-mounting.patch
---

diff --git a/queue-3.18/series b/queue-3.18/series
index 2f8b42e5030..c3444944f1e 100644
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -116,3 +116,4 @@ ext4-add-more-inode-number-paranoia-checks.patch
 jbd2-don-t-mark-block-as-modified-if-the-handle-is-out-of-credits.patch
 ext4-avoid-running-out-of-journal-credits-when-appending-to-an-inline-file.patch
 cgroup-fix-deadlock-in-cpu-hotplug-path.patch
+ubifs-check-for-name-being-null-while-mounting.patch
diff --git a/queue-3.18/ubifs-check-for-name-being-null-while-mounting.patch b/queue-3.18/ubifs-check-for-name-being-null-while-mounting.patch
new file mode 100644
index 00000000000..8187cee8f25
--- /dev/null
+++ b/queue-3.18/ubifs-check-for-name-being-null-while-mounting.patch
@@ -0,0 +1,34 @@
+From 37f31b6ca4311b94d985fb398a72e5399ad57925 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Mon, 3 Sep 2018 23:06:23 +0200
+Subject: ubifs: Check for name being NULL while mounting
+
+From: Richard Weinberger <richard@nod.at>
+
+commit 37f31b6ca4311b94d985fb398a72e5399ad57925 upstream.
+
+The requested device name can be NULL or an empty string.
+Check for that and refuse to continue. UBIFS has to do this manually
+since we cannot use mount_bdev(), which checks for this condition.
+
+Fixes: 1e51764a3c2ac ("UBIFS: add new flash file system")
+Reported-by: syzbot+38bd0f7865e5c6379280@syzkaller.appspotmail.com
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/super.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1917,6 +1917,9 @@ static struct ubi_volume_desc *open_ubi(
+ 	int dev, vol;
+ 	char *endptr;
+ 
++	if (!name || !*name)
++		return ERR_PTR(-EINVAL);
++
+ 	/* First, try to open using the device node path method */
+ 	ubi = ubi_open_volume_path(name, mode);
+ 	if (!IS_ERR(ubi))