patches/kernel/0272-udf-prevent-speculative-execution.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Elena Reshetova <elena.reshetova@intel.com>
   3 Date: Mon, 4 Sep 2017 13:11:56 +0300
   4 Subject: [PATCH] udf: prevent speculative execution
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5753
  10 CVE-2017-5715
  11
  12 Real commit text tbd
  13
  14 Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
  15 Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
  16 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  17 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  18 (cherry picked from commit f575840dd363aa80a14faacddf90b95db1185e2c)
  19 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  20 ---
  21  fs/udf/misc.c | 6 ++++++
  22  1 file changed, 6 insertions(+)
  23
  24 diff --git a/fs/udf/misc.c b/fs/udf/misc.c
  25 index 3949c4bec3a3..4bd10b2e8540 100644
  26 --- a/fs/udf/misc.c
  27 +++ b/fs/udf/misc.c
  28 @@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
  29                                         iinfo->i_lenEAttr) {
  30                                 uint32_t aal =
  31                                         le32_to_cpu(eahd->appAttrLocation);
  32 +
  33 +                               gmb();
  34                                 memmove(&ea[offset - aal + size],
  35                                         &ea[aal], offset - aal);
  36                                 offset -= aal;
  37 @@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
  38                                         iinfo->i_lenEAttr) {
  39                                 uint32_t ial =
  40                                         le32_to_cpu(eahd->impAttrLocation);
  41 +
  42 +                               gmb();
  43                                 memmove(&ea[offset - ial + size],
  44                                         &ea[ial], offset - ial);
  45                                 offset -= ial;
  46 @@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size,
  47                                         iinfo->i_lenEAttr) {
  48                                 uint32_t aal =
  49                                         le32_to_cpu(eahd->appAttrLocation);
  50 +
  51 +                               gmb();
  52                                 memmove(&ea[offset - aal + size],
  53                                         &ea[aal], offset - aal);
  54                                 offset -= aal;
  55 --
  56 2.14.2
  57