diff options
| -rw-r--r-- | SOURCES/CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch | 305 | ||||
| -rw-r--r-- | SOURCES/bluetooth_cves.patch | 320 | ||||
| -rw-r--r-- | SPECS/kernel.spec | 25 |
3 files changed, 641 insertions, 9 deletions
diff --git a/SOURCES/CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch b/SOURCES/CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch new file mode 100644 index 0000000..7eb981e --- /dev/null +++ b/SOURCES/CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch @@ -0,0 +1,305 @@ +From MAILER-DAEMON Wed Oct 14 16:34:37 2020 +From: Kleber Sacilotto de Souza <kleber.souza@canonical.com> +To: netdev@vger.kernel.org +Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>, Thadeu Lima de Souza Cascardo <cascardo@canonical.com>, "Gustavo A. R. Silva" <gustavoars@kernel.org>, "Alexander A. Klimov" <grandmaster@al2klimov.de>, Kees Cook <keescook@chromium.org>, Eric Dumazet <edumazet@google.com>, Alexey Kodanev <alexey.kodanev@oracle.com>, dccp@vger.kernel.org, linux-kernel@vger.kernel.org +Subject: [PATCH 1/2] dccp: ccid: move timers to struct dccp_sock +Date: Tue, 13 Oct 2020 19:18:48 +0200 +Message-Id: <20201013171849.236025-2-kleber.souza@canonical.com> +In-Reply-To: <20201013171849.236025-1-kleber.souza@canonical.com> +References: <20201013171849.236025-1-kleber.souza@canonical.com> +List-ID: <linux-kernel.vger.kernel.org> +X-Mailing-List: linux-kernel@vger.kernel.org +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 7bit + +From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> + +When dccps_hc_tx_ccid is freed, ccid timers may still trigger. The reason +del_timer_sync can't be used is because this relies on keeping a reference +to struct sock. But as we keep a pointer to dccps_hc_tx_ccid and free that +during disconnect, the timer should really belong to struct dccp_sock. + +This addresses CVE-2020-16119. + +Fixes: 839a6094140a (net: dccp: Convert timers to use timer_setup()) +Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> +Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> +Acked-bd: Richard Sailer <richard_siegfried@systemli.org> +--- + include/linux/dccp.h | 2 ++ + net/dccp/ccids/ccid2.c | 32 +++++++++++++++++++------------- + net/dccp/ccids/ccid3.c | 30 ++++++++++++++++++++---------- + 3 files changed, 41 insertions(+), 23 deletions(-) + +diff --git a/include/linux/dccp.h b/include/linux/dccp.h +index 07e547c02fd8..504afa1a4be6 100644 +--- a/include/linux/dccp.h ++++ b/include/linux/dccp.h +@@ -259,6 +259,7 @@ struct dccp_ackvec; + * @dccps_sync_scheduled - flag which signals "send out-of-band message soon" + * @dccps_xmitlet - tasklet scheduled by the TX CCID to dequeue data packets + * @dccps_xmit_timer - used by the TX CCID to delay sending (rate-based pacing) ++ * @dccps_ccid_timer - used by the CCIDs + * @dccps_syn_rtt - RTT sample from Request/Response exchange (in usecs) + */ + struct dccp_sock { +@@ -303,6 +304,7 @@ struct dccp_sock { + __u8 dccps_sync_scheduled:1; + struct tasklet_struct dccps_xmitlet; + struct timer_list dccps_xmit_timer; ++ struct timer_list dccps_ccid_timer; + }; + + static inline struct dccp_sock *dccp_sk(const struct sock *sk) +diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c +index 3da1f77bd039..dbca1f1e2449 100644 +--- a/net/dccp/ccids/ccid2.c ++++ b/net/dccp/ccids/ccid2.c +@@ -126,21 +126,26 @@ static void dccp_tasklet_schedule(struct sock *sk) + + static void ccid2_hc_tx_rto_expire(struct timer_list *t) + { +- struct ccid2_hc_tx_sock *hc = from_timer(hc, t, tx_rtotimer); +- struct sock *sk = hc->sk; +- const bool sender_was_blocked = ccid2_cwnd_network_limited(hc); ++ struct dccp_sock *dp = from_timer(dp, t, dccps_ccid_timer); ++ struct sock *sk = (struct sock *)dp; ++ struct ccid2_hc_tx_sock *hc; ++ bool sender_was_blocked; + + bh_lock_sock(sk); ++ ++ if (inet_sk_state_load(sk) == DCCP_CLOSED) ++ goto out; ++ ++ hc = ccid_priv(dp->dccps_hc_tx_ccid); ++ sender_was_blocked = ccid2_cwnd_network_limited(hc); ++ + if (sock_owned_by_user(sk)) { +- sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + HZ / 5); ++ sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + HZ / 5); + goto out; + } + + ccid2_pr_debug("RTO_EXPIRE\n"); + +- if (sk->sk_state == DCCP_CLOSED) +- goto out; +- + /* back-off timer */ + hc->tx_rto <<= 1; + if (hc->tx_rto > DCCP_RTO_MAX) +@@ -166,7 +171,7 @@ static void ccid2_hc_tx_rto_expire(struct timer_list *t) + if (sender_was_blocked) + dccp_tasklet_schedule(sk); + /* restart backed-off timer */ +- sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto); ++ sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto); + out: + bh_unlock_sock(sk); + sock_put(sk); +@@ -330,7 +335,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, unsigned int len) + } + #endif + +- sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto); ++ sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto); + + #ifdef CONFIG_IP_DCCP_CCID2_DEBUG + do { +@@ -700,9 +705,9 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb) + + /* restart RTO timer if not all outstanding data has been acked */ + if (hc->tx_pipe == 0) +- sk_stop_timer(sk, &hc->tx_rtotimer); ++ sk_stop_timer(sk, &dp->dccps_ccid_timer); + else +- sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto); ++ sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto); + done: + /* check if incoming Acks allow pending packets to be sent */ + if (sender_was_blocked && !ccid2_cwnd_network_limited(hc)) +@@ -737,17 +742,18 @@ static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk) + hc->tx_last_cong = hc->tx_lsndtime = hc->tx_cwnd_stamp = ccid2_jiffies32; + hc->tx_cwnd_used = 0; + hc->sk = sk; +- timer_setup(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire, 0); ++ timer_setup(&dp->dccps_ccid_timer, ccid2_hc_tx_rto_expire, 0); + INIT_LIST_HEAD(&hc->tx_av_chunks); + return 0; + } + + static void ccid2_hc_tx_exit(struct sock *sk) + { ++ struct dccp_sock *dp = dccp_sk(sk); + struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk); + int i; + +- sk_stop_timer(sk, &hc->tx_rtotimer); ++ sk_stop_timer(sk, &dp->dccps_ccid_timer); + + for (i = 0; i < hc->tx_seqbufc; i++) + kfree(hc->tx_seqbuf[i]); +diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c +index b9ee1a4a8955..685f4d046c0d 100644 +--- a/net/dccp/ccids/ccid3.c ++++ b/net/dccp/ccids/ccid3.c +@@ -184,17 +184,24 @@ static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hc, + + static void ccid3_hc_tx_no_feedback_timer(struct timer_list *t) + { +- struct ccid3_hc_tx_sock *hc = from_timer(hc, t, tx_no_feedback_timer); +- struct sock *sk = hc->sk; ++ struct dccp_sock *dp = from_timer(dp, t, dccps_ccid_timer); ++ struct ccid3_hc_tx_sock *hc; ++ struct sock *sk = (struct sock *)dp; + unsigned long t_nfb = USEC_PER_SEC / 5; + + bh_lock_sock(sk); ++ ++ if (inet_sk_state_load(sk) == DCCP_CLOSED) ++ goto out; ++ + if (sock_owned_by_user(sk)) { + /* Try again later. */ + /* XXX: set some sensible MIB */ + goto restart_timer; + } + ++ hc = ccid_priv(dp->dccps_hc_tx_ccid); ++ + ccid3_pr_debug("%s(%p, state=%s) - entry\n", dccp_role(sk), sk, + ccid3_tx_state_name(hc->tx_state)); + +@@ -250,8 +257,8 @@ static void ccid3_hc_tx_no_feedback_timer(struct timer_list *t) + t_nfb = max(hc->tx_t_rto, 2 * hc->tx_t_ipi); + + restart_timer: +- sk_reset_timer(sk, &hc->tx_no_feedback_timer, +- jiffies + usecs_to_jiffies(t_nfb)); ++ sk_reset_timer(sk, &dp->dccps_ccid_timer, ++ jiffies + usecs_to_jiffies(t_nfb)); + out: + bh_unlock_sock(sk); + sock_put(sk); +@@ -280,7 +287,7 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb) + return -EBADMSG; + + if (hc->tx_state == TFRC_SSTATE_NO_SENT) { +- sk_reset_timer(sk, &hc->tx_no_feedback_timer, (jiffies + ++ sk_reset_timer(sk, &dp->dccps_ccid_timer, (jiffies + + usecs_to_jiffies(TFRC_INITIAL_TIMEOUT))); + hc->tx_last_win_count = 0; + hc->tx_t_last_win_count = now; +@@ -354,6 +361,7 @@ static void ccid3_hc_tx_packet_sent(struct sock *sk, unsigned int len) + static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb) + { + struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk); ++ struct dccp_sock *dp = dccp_sk(sk); + struct tfrc_tx_hist_entry *acked; + ktime_t now; + unsigned long t_nfb; +@@ -420,7 +428,7 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb) + (unsigned int)(hc->tx_x >> 6)); + + /* unschedule no feedback timer */ +- sk_stop_timer(sk, &hc->tx_no_feedback_timer); ++ sk_stop_timer(sk, &dp->dccps_ccid_timer); + + /* + * As we have calculated new ipi, delta, t_nom it is possible +@@ -445,8 +453,8 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb) + "expire in %lu jiffies (%luus)\n", + dccp_role(sk), sk, usecs_to_jiffies(t_nfb), t_nfb); + +- sk_reset_timer(sk, &hc->tx_no_feedback_timer, +- jiffies + usecs_to_jiffies(t_nfb)); ++ sk_reset_timer(sk, &dp->dccps_ccid_timer, ++ jiffies + usecs_to_jiffies(t_nfb)); + } + + static int ccid3_hc_tx_parse_options(struct sock *sk, u8 packet_type, +@@ -488,21 +496,23 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, u8 packet_type, + + static int ccid3_hc_tx_init(struct ccid *ccid, struct sock *sk) + { ++ struct dccp_sock *dp = dccp_sk(sk); + struct ccid3_hc_tx_sock *hc = ccid_priv(ccid); + + hc->tx_state = TFRC_SSTATE_NO_SENT; + hc->tx_hist = NULL; + hc->sk = sk; +- timer_setup(&hc->tx_no_feedback_timer, ++ timer_setup(&dp->dccps_ccid_timer, + ccid3_hc_tx_no_feedback_timer, 0); + return 0; + } + + static void ccid3_hc_tx_exit(struct sock *sk) + { ++ struct dccp_sock *dp = dccp_sk(sk); + struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk); + +- sk_stop_timer(sk, &hc->tx_no_feedback_timer); ++ sk_stop_timer(sk, &dp->dccps_ccid_timer); + tfrc_tx_hist_purge(&hc->tx_hist); + } + +-- +2.25.1 + + +From MAILER-DAEMON Wed Oct 14 16:34:37 2020 +From: Kleber Sacilotto de Souza <kleber.souza@canonical.com> +To: netdev@vger.kernel.org +Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>, Thadeu Lima de Souza Cascardo <cascardo@canonical.com>, "Gustavo A. R. Silva" <gustavoars@kernel.org>, "Alexander A. Klimov" <grandmaster@al2klimov.de>, Kees Cook <keescook@chromium.org>, Eric Dumazet <edumazet@google.com>, Alexey Kodanev <alexey.kodanev@oracle.com>, dccp@vger.kernel.org, linux-kernel@vger.kernel.org +Subject: [PATCH 2/2] Revert "dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()" +Date: Tue, 13 Oct 2020 19:18:49 +0200 +Message-Id: <20201013171849.236025-3-kleber.souza@canonical.com> +In-Reply-To: <20201013171849.236025-1-kleber.souza@canonical.com> +References: <20201013171849.236025-1-kleber.souza@canonical.com> +List-ID: <linux-kernel.vger.kernel.org> +X-Mailing-List: linux-kernel@vger.kernel.org +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 7bit + +From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> + +This reverts commit 2677d20677314101293e6da0094ede7b5526d2b1. + +This fixes an issue that after disconnect, dccps_hc_tx_ccid will still be +kept, allowing the socket to be reused as a listener socket, and the cloned +socket will free its dccps_hc_tx_ccid, leading to a later use after free, +when the listener socket is closed. + +This addresses CVE-2020-16119. + +Fixes: 2677d2067731 (dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()) +Reported-by: Hadar Manor +Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> +Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> +Acked-by: Richard Sailer <richard_siegfried@systemli.org> +--- + net/dccp/proto.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index 6d705d90c614..359e848dba6c 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -279,7 +279,9 @@ int dccp_disconnect(struct sock *sk, int flags) + + dccp_clear_xmit_timers(sk); + ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); ++ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_rx_ccid = NULL; ++ dp->dccps_hc_tx_ccid = NULL; + + __skb_queue_purge(&sk->sk_receive_queue); + __skb_queue_purge(&sk->sk_write_queue); +-- +2.25.1 + + diff --git a/SOURCES/bluetooth_cves.patch b/SOURCES/bluetooth_cves.patch new file mode 100644 index 0000000..129b0d0 --- /dev/null +++ b/SOURCES/bluetooth_cves.patch @@ -0,0 +1,320 @@ +From MAILER-DAEMON Thu Oct 15 15:17:31 2020 +From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> +To: linux-bluetooth@vger.kernel.org +Subject: [PATCH 1/4] Bluetooth: A2MP: Fix not initializing all members +Date: Thu, 06 Aug 2020 11:17:11 -0700 +Message-Id: <20200806181714.3216076-1-luiz.dentz@gmail.com> +Sender: linux-bluetooth-owner@vger.kernel.org +List-ID: <linux-bluetooth.vger.kernel.org> +X-Mailing-List: linux-bluetooth@vger.kernel.org +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 7bit + +From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> + +This fixes various places where a stack variable is used uninitialized. + +Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> +--- + net/bluetooth/a2mp.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c +index 26526be579c7..da7fd7c8c2dc 100644 +--- a/net/bluetooth/a2mp.c ++++ b/net/bluetooth/a2mp.c +@@ -226,6 +226,9 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_info_req req; + + found = true; ++ ++ memset(&req, 0, sizeof(req)); ++ + req.id = cl->id; + a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr), + sizeof(req), &req); +@@ -305,6 +308,8 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb, + if (!hdev || hdev->dev_type != HCI_AMP) { + struct a2mp_info_rsp rsp; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.id = req->id; + rsp.status = A2MP_STATUS_INVALID_CTRL_ID; + +@@ -348,6 +353,8 @@ static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb, + if (!ctrl) + return -ENOMEM; + ++ memset(&req, 0, sizeof(req)); ++ + req.id = rsp->id; + a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req), + &req); +@@ -376,6 +383,8 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_amp_assoc_rsp rsp; + rsp.id = req->id; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + if (tmp) { + rsp.status = A2MP_STATUS_COLLISION_OCCURED; + amp_mgr_put(tmp); +@@ -464,7 +473,6 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_cmd *hdr) + { + struct a2mp_physlink_req *req = (void *) skb->data; +- + struct a2mp_physlink_rsp rsp; + struct hci_dev *hdev; + struct hci_conn *hcon; +@@ -475,6 +483,8 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + + BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.local_id = req->remote_id; + rsp.remote_id = req->local_id; + +@@ -553,6 +563,8 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + + BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.local_id = req->remote_id; + rsp.remote_id = req->local_id; + rsp.status = A2MP_STATUS_SUCCESS; +@@ -675,6 +687,8 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) + if (err) { + struct a2mp_cmd_rej rej; + ++ memset(&rej, 0, sizeof(rej)); ++ + rej.reason = cpu_to_le16(0); + hdr = (void *) skb->data; + +@@ -898,6 +912,8 @@ void a2mp_send_getinfo_rsp(struct hci_dev *hdev) + + BT_DBG("%s mgr %p", hdev->name, mgr); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.id = hdev->id; + rsp.status = A2MP_STATUS_INVALID_CTRL_ID; + +@@ -995,6 +1011,8 @@ void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status) + if (!mgr) + return; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT); + if (!hs_hcon) { + rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; +@@ -1027,6 +1045,8 @@ void a2mp_discover_amp(struct l2cap_chan *chan) + + mgr->bredr_chan = chan; + ++ memset(&req, 0, sizeof(req)); ++ + req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); + req.ext_feat = 0; + a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req); +-- +2.26.2 + + +From MAILER-DAEMON Thu Oct 15 15:17:31 2020 +From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> +To: linux-bluetooth@vger.kernel.org +Subject: [PATCH 2/4] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel +Date: Thu, 06 Aug 2020 11:17:12 -0700 +Message-Id: <20200806181714.3216076-2-luiz.dentz@gmail.com> +In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com> +References: <20200806181714.3216076-1-luiz.dentz@gmail.com> +Sender: linux-bluetooth-owner@vger.kernel.org +List-ID: <linux-bluetooth.vger.kernel.org> +X-Mailing-List: linux-bluetooth@vger.kernel.org +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 7bit + +From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> + +Only sockets will have the chan->data set to an actual sk, channels +like A2MP would have its own data which would likely cause a crash when +calling sk_filter, in order to fix this a new callback has been +introduced so channels can implement their own filtering if necessary. + +Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> +--- + include/net/bluetooth/l2cap.h | 2 ++ + net/bluetooth/l2cap_core.c | 7 ++++--- + net/bluetooth/l2cap_sock.c | 14 ++++++++++++++ + 3 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h +index bc5e9fbc3853..61800a7b6192 100644 +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -666,6 +666,8 @@ struct l2cap_ops { + struct sk_buff *(*alloc_skb) (struct l2cap_chan *chan, + unsigned long hdr_len, + unsigned long len, int nb); ++ int (*filter) (struct l2cap_chan * chan, ++ struct sk_buff *skb); + }; + + struct l2cap_conn { +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index a4458c07b5e5..4a6b5e40e5e4 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -7301,9 +7301,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) + goto drop; + } + +- if ((chan->mode == L2CAP_MODE_ERTM || +- chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb)) +- goto drop; ++ if (chan->ops->filter) { ++ if (chan->ops->filter(chan, skb)) ++ goto drop; ++ } + + if (!control->sframe) { + int err; +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index e1a3e66b1754..79b4c01c515b 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1663,6 +1663,19 @@ static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) + sk->sk_state_change(sk); + } + ++static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) ++{ ++ struct sock *sk = chan->data; ++ ++ switch (chan->mode) { ++ case L2CAP_MODE_ERTM: ++ case L2CAP_MODE_STREAMING: ++ return sk_filter(sk, skb); ++ } ++ ++ return 0; ++} ++ + static const struct l2cap_ops l2cap_chan_ops = { + .name = "L2CAP Socket Interface", + .new_connection = l2cap_sock_new_connection_cb, +@@ -1678,6 +1691,7 @@ static const struct l2cap_ops l2cap_chan_ops = { + .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, + .get_peer_pid = l2cap_sock_get_peer_pid_cb, + .alloc_skb = l2cap_sock_alloc_skb_cb, ++ .filter = l2cap_sock_filter, + }; + + static void l2cap_sock_destruct(struct sock *sk) +-- +2.26.2 + + +From MAILER-DAEMON Thu Oct 15 15:17:31 2020 +From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> +To: linux-bluetooth@vger.kernel.org +Subject: [PATCH 3/4] Bluetooth: Disable High Speed by default +Date: Thu, 06 Aug 2020 11:17:13 -0700 +Message-Id: <20200806181714.3216076-3-luiz.dentz@gmail.com> +In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com> +References: <20200806181714.3216076-1-luiz.dentz@gmail.com> +Sender: linux-bluetooth-owner@vger.kernel.org +List-ID: <linux-bluetooth.vger.kernel.org> +X-Mailing-List: linux-bluetooth@vger.kernel.org +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 7bit + +From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> + +Bluetooth High Speed requires hardware support which is very uncommon +nowadays since HS has not pickup interest by the industry. + +Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> +--- + net/bluetooth/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig +index e2497d764e97..64e669acd42f 100644 +--- a/net/bluetooth/Kconfig ++++ b/net/bluetooth/Kconfig +@@ -64,7 +64,6 @@ source "net/bluetooth/hidp/Kconfig" + config BT_HS + bool "Bluetooth High Speed (HS) features" + depends on BT_BREDR +- default y + help + Bluetooth High Speed includes support for off-loading + Bluetooth connections via 802.11 (wifi) physical layer +-- +2.26.2 + + +From MAILER-DAEMON Thu Oct 15 15:17:31 2020 +From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> +To: linux-bluetooth@vger.kernel.org +Subject: [PATCH 4/4] Bluetooth: MGMT: Fix not checking if BT_HS is enabled +Date: Thu, 06 Aug 2020 11:17:14 -0700 +Message-Id: <20200806181714.3216076-4-luiz.dentz@gmail.com> +In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com> +References: <20200806181714.3216076-1-luiz.dentz@gmail.com> +Sender: linux-bluetooth-owner@vger.kernel.org +List-ID: <linux-bluetooth.vger.kernel.org> +X-Mailing-List: linux-bluetooth@vger.kernel.org +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 7bit + +From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> + +This checks if BT_HS is enabled relecting it on MGMT_SETTING_HS instead +of always reporting it as supported. + +Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> +--- + net/bluetooth/mgmt.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 5bbe71002fb9..5758ccb524ef 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -782,7 +782,8 @@ static u32 get_supported_settings(struct hci_dev *hdev) + + if (lmp_ssp_capable(hdev)) { + settings |= MGMT_SETTING_SSP; +- settings |= MGMT_SETTING_HS; ++ if (IS_ENABLED(CONFIG_BT_HS)) ++ settings |= MGMT_SETTING_HS; + } + + if (lmp_sc_capable(hdev)) +@@ -1815,6 +1816,10 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) + + bt_dev_dbg(hdev, "sock %p", sk); + ++ if (!IS_ENABLED(CONFIG_BT_HS)) ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, ++ MGMT_STATUS_NOT_SUPPORTED); ++ + status = mgmt_bredr_support(hdev); + if (status) + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); +-- +2.26.2 + + diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 7d8395f..a6be295 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -80,7 +80,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 201 +%global baserelease 202 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -92,7 +92,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 14 +%define stable_update 15 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -869,9 +869,6 @@ Patch107: 0001-drivers-perf-xgene_pmu-Fix-uninitialized-resource-st.patch Patch110: memory-tegra-Remove-GPU-from-DRM-IOMMU-group.patch -# rhbz 1875339 1875828 1876997 -Patch113: pdx86-SW_TABLET_MODE-fixes.patch - # https://patchwork.kernel.org/patch/11796255/ Patch116: arm64-dts-rockchip-disable-USB-type-c-DisplayPort.patch @@ -881,8 +878,11 @@ Patch117: arm64-pwm-rockchip-Keep-enabled-PWMs-running-while-probing.patch # Backport from 5.9 Patch118: arm64-rockchip-pinebookpro-add-fuel-gauge.patch -# https://patchwork.kernel.org/patch/11818995 -Patch121: arm64-BUG-crypto-arm64-Use-x16-with-indirect-branch-to-bti_c.patch +# CVE-2020-16119 rhbz 1886374 1888083 +Patch119: CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch + +# CVE-2020-12351 CVE-2020-12352 rhbz 1886521 1888439 1886529 1888440 +Patch122: bluetooth_cves.patch # Linux-tkg patches - https://github.com/Frogging-Family/linux-tkg/blob/master/linux57-tkg Patch200: 0007-v5.8-fsync.patch @@ -3000,8 +3000,15 @@ fi # # %changelog -* Thu Oct 15 2020 Jan Drögehoff <sentrycraft123@gmail.com> - 5.8.14-201.fsync -- Linux v5.8.14 fsync +* Sat Oct 17 2020 Jan Drögehoff <sentrycraft123@gmail.com> - 5.8.15-202.fsync +- Linux v5.8.15 fsync + +* Thu Oct 15 2020 Justin M. Forbes <jforbes@fedoraproject.org> - 5.8.15-201 +- Fix BleedingTooth CVE-2020-12351 CVE-2020-12352 (rhbz 1886521 1888439 1886529 1888440) + +* Wed Oct 14 11:29:47 CDT 2020 Justin M. Forbes <jforbes@fedoraproject.org> - 5.8.15-200 +- Linux v5.8.15 +- Fix CVE-2020-16119 (rhbz 1886374 1888083) * Wed Oct 7 07:21:23 CDT 2020 Justin M. Forbes <jforbes@fedoraproject.org> - 5.8.14-200 - Linux v5.8.14 |