tag 611247b5ae0dc940c2675976e324451ede328237
tagger Todd Kjos <tkjos@google.com> Mon Jan 07 10:43:36 2019 -0800
object 765500b10116d1a3ac835dc274b6106d78929d74

https://source.android.com/security/bulletin/2019-01-01
CVE-2018-10876
CVE-2018-10880
CVE-2018-10882
CVE-2018-13405
CVE-2018-18281
CVE-2018-17182
CVE-2018-10877

commit 765500b10116d1a3ac835dc274b6106d78929d74
author Theodore Ts'o <tytso@mit.edu> Sun Jun 17 00:41:14 2018 -0400
committer Todd Kjos <tkjos@google.com> Fri Jan 04 09:07:21 2019 -0800
tree 73b195d871f1e55499be2c6451e7a2ec43f8f367
parent 9be9a7fcc1c84dd72d595f67eb9593a2741b4eed

ext4: add more inode number paranoia checks

commit c37e9e013469521d9adb932d17a1795c139b36db upstream.

If there is a directory entry pointing to a system inode (such as a
journal inode), complain and declare the file system to be corrupted.

Also, if the superblock's first inode number field is too small,
refuse to mount the file system.

This addresses CVE-2018-10882.

https://bugzilla.kernel.org/show_bug.cgi?id=200069

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>