merge origin

2 files changed, 3 insertions, 323 deletions

diff --git a/bluetooth_cves.patch b/bluetooth_cves.patch
deleted file mode 100644
index 129b0d055..000000000
--- a/bluetooth_cves.patch
+++ /dev/null
@@ -1,320 +0,0 @@
-From MAILER-DAEMON Thu Oct 15 15:17:31 2020
-From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
-To: linux-bluetooth@vger.kernel.org
-Subject: [PATCH 1/4] Bluetooth: A2MP: Fix not initializing all members
-Date: Thu, 06 Aug 2020 11:17:11 -0700
-Message-Id: <20200806181714.3216076-1-luiz.dentz@gmail.com>
-Sender: linux-bluetooth-owner@vger.kernel.org
-List-ID: <linux-bluetooth.vger.kernel.org>
-X-Mailing-List: linux-bluetooth@vger.kernel.org
-MIME-Version: 1.0
-Content-Type: text/plain; charset="utf-8"
-Content-Transfer-Encoding: 7bit
-
-From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
-This fixes various places where a stack variable is used uninitialized.
-
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
----
- net/bluetooth/a2mp.c | 22 +++++++++++++++++++++-
- 1 file changed, 21 insertions(+), 1 deletion(-)
-
-diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
-index 26526be579c7..da7fd7c8c2dc 100644
---- a/net/bluetooth/a2mp.c
-+++ b/net/bluetooth/a2mp.c
-@@ -226,6 +226,9 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
- 			struct a2mp_info_req req;
- 
- 			found = true;
-+
-+			memset(&req, 0, sizeof(req));
-+
- 			req.id = cl->id;
- 			a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr),
- 				  sizeof(req), &req);
-@@ -305,6 +308,8 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
- 	if (!hdev || hdev->dev_type != HCI_AMP) {
- 		struct a2mp_info_rsp rsp;
- 
-+		memset(&rsp, 0, sizeof(rsp));
-+
- 		rsp.id = req->id;
- 		rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
- 
-@@ -348,6 +353,8 @@ static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
- 	if (!ctrl)
- 		return -ENOMEM;
- 
-+	memset(&req, 0, sizeof(req));
-+
- 	req.id = rsp->id;
- 	a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req),
- 		  &req);
-@@ -376,6 +383,8 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
- 		struct a2mp_amp_assoc_rsp rsp;
- 		rsp.id = req->id;
- 
-+		memset(&rsp, 0, sizeof(rsp));
-+
- 		if (tmp) {
- 			rsp.status = A2MP_STATUS_COLLISION_OCCURED;
- 			amp_mgr_put(tmp);
-@@ -464,7 +473,6 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
- 				   struct a2mp_cmd *hdr)
- {
- 	struct a2mp_physlink_req *req = (void *) skb->data;
--
- 	struct a2mp_physlink_rsp rsp;
- 	struct hci_dev *hdev;
- 	struct hci_conn *hcon;
-@@ -475,6 +483,8 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
- 
- 	BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id);
- 
-+	memset(&rsp, 0, sizeof(rsp));
-+
- 	rsp.local_id = req->remote_id;
- 	rsp.remote_id = req->local_id;
- 
-@@ -553,6 +563,8 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
- 
- 	BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id);
- 
-+	memset(&rsp, 0, sizeof(rsp));
-+
- 	rsp.local_id = req->remote_id;
- 	rsp.remote_id = req->local_id;
- 	rsp.status = A2MP_STATUS_SUCCESS;
-@@ -675,6 +687,8 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
- 	if (err) {
- 		struct a2mp_cmd_rej rej;
- 
-+		memset(&rej, 0, sizeof(rej));
-+
- 		rej.reason = cpu_to_le16(0);
- 		hdr = (void *) skb->data;
- 
-@@ -898,6 +912,8 @@ void a2mp_send_getinfo_rsp(struct hci_dev *hdev)
- 
- 	BT_DBG("%s mgr %p", hdev->name, mgr);
- 
-+	memset(&rsp, 0, sizeof(rsp));
-+
- 	rsp.id = hdev->id;
- 	rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
- 
-@@ -995,6 +1011,8 @@ void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status)
- 	if (!mgr)
- 		return;
- 
-+	memset(&rsp, 0, sizeof(rsp));
-+
- 	hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT);
- 	if (!hs_hcon) {
- 		rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
-@@ -1027,6 +1045,8 @@ void a2mp_discover_amp(struct l2cap_chan *chan)
- 
- 	mgr->bredr_chan = chan;
- 
-+	memset(&req, 0, sizeof(req));
-+
- 	req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
- 	req.ext_feat = 0;
- 	a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req);
--- 
-2.26.2
-
-
-From MAILER-DAEMON Thu Oct 15 15:17:31 2020
-From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
-To: linux-bluetooth@vger.kernel.org
-Subject: [PATCH 2/4] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel
-Date: Thu, 06 Aug 2020 11:17:12 -0700
-Message-Id: <20200806181714.3216076-2-luiz.dentz@gmail.com>
-In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com>
-References: <20200806181714.3216076-1-luiz.dentz@gmail.com>
-Sender: linux-bluetooth-owner@vger.kernel.org
-List-ID: <linux-bluetooth.vger.kernel.org>
-X-Mailing-List: linux-bluetooth@vger.kernel.org
-MIME-Version: 1.0
-Content-Type: text/plain; charset="utf-8"
-Content-Transfer-Encoding: 7bit
-
-From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
-Only sockets will have the chan->data set to an actual sk, channels
-like A2MP would have its own data which would likely cause a crash when
-calling sk_filter, in order to fix this a new callback has been
-introduced so channels can implement their own filtering if necessary.
-
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
----
- include/net/bluetooth/l2cap.h |  2 ++
- net/bluetooth/l2cap_core.c    |  7 ++++---
- net/bluetooth/l2cap_sock.c    | 14 ++++++++++++++
- 3 files changed, 20 insertions(+), 3 deletions(-)
-
-diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
-index bc5e9fbc3853..61800a7b6192 100644
---- a/include/net/bluetooth/l2cap.h
-+++ b/include/net/bluetooth/l2cap.h
-@@ -666,6 +666,8 @@ struct l2cap_ops {
- 	struct sk_buff		*(*alloc_skb) (struct l2cap_chan *chan,
- 					       unsigned long hdr_len,
- 					       unsigned long len, int nb);
-+	int			(*filter) (struct l2cap_chan * chan,
-+					   struct sk_buff *skb);
- };
- 
- struct l2cap_conn {
-diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index a4458c07b5e5..4a6b5e40e5e4 100644
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -7301,9 +7301,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
- 		goto drop;
- 	}
- 
--	if ((chan->mode == L2CAP_MODE_ERTM ||
--	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
--		goto drop;
-+	if (chan->ops->filter) {
-+		if (chan->ops->filter(chan, skb))
-+			goto drop;
-+	}
- 
- 	if (!control->sframe) {
- 		int err;
-diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
-index e1a3e66b1754..79b4c01c515b 100644
---- a/net/bluetooth/l2cap_sock.c
-+++ b/net/bluetooth/l2cap_sock.c
-@@ -1663,6 +1663,19 @@ static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
- 	sk->sk_state_change(sk);
- }
- 
-+static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
-+{
-+	struct sock *sk = chan->data;
-+
-+	switch (chan->mode) {
-+	case L2CAP_MODE_ERTM:
-+	case L2CAP_MODE_STREAMING:
-+		return sk_filter(sk, skb);
-+	}
-+
-+	return 0;
-+}
-+
- static const struct l2cap_ops l2cap_chan_ops = {
- 	.name			= "L2CAP Socket Interface",
- 	.new_connection		= l2cap_sock_new_connection_cb,
-@@ -1678,6 +1691,7 @@ static const struct l2cap_ops l2cap_chan_ops = {
- 	.get_sndtimeo		= l2cap_sock_get_sndtimeo_cb,
- 	.get_peer_pid		= l2cap_sock_get_peer_pid_cb,
- 	.alloc_skb		= l2cap_sock_alloc_skb_cb,
-+	.filter			= l2cap_sock_filter,
- };
- 
- static void l2cap_sock_destruct(struct sock *sk)
--- 
-2.26.2
-
-
-From MAILER-DAEMON Thu Oct 15 15:17:31 2020
-From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
-To: linux-bluetooth@vger.kernel.org
-Subject: [PATCH 3/4] Bluetooth: Disable High Speed by default
-Date: Thu, 06 Aug 2020 11:17:13 -0700
-Message-Id: <20200806181714.3216076-3-luiz.dentz@gmail.com>
-In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com>
-References: <20200806181714.3216076-1-luiz.dentz@gmail.com>
-Sender: linux-bluetooth-owner@vger.kernel.org
-List-ID: <linux-bluetooth.vger.kernel.org>
-X-Mailing-List: linux-bluetooth@vger.kernel.org
-MIME-Version: 1.0
-Content-Type: text/plain; charset="utf-8"
-Content-Transfer-Encoding: 7bit
-
-From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
-Bluetooth High Speed requires hardware support which is very uncommon
-nowadays since HS has not pickup interest by the industry.
-
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
----
- net/bluetooth/Kconfig | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
-index e2497d764e97..64e669acd42f 100644
---- a/net/bluetooth/Kconfig
-+++ b/net/bluetooth/Kconfig
-@@ -64,7 +64,6 @@ source "net/bluetooth/hidp/Kconfig"
- config BT_HS
- 	bool "Bluetooth High Speed (HS) features"
- 	depends on BT_BREDR
--	default y
- 	help
- 	  Bluetooth High Speed includes support for off-loading
- 	  Bluetooth connections via 802.11 (wifi) physical layer
--- 
-2.26.2
-
-
-From MAILER-DAEMON Thu Oct 15 15:17:31 2020
-From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
-To: linux-bluetooth@vger.kernel.org
-Subject: [PATCH 4/4] Bluetooth: MGMT: Fix not checking if BT_HS is enabled
-Date: Thu, 06 Aug 2020 11:17:14 -0700
-Message-Id: <20200806181714.3216076-4-luiz.dentz@gmail.com>
-In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com>
-References: <20200806181714.3216076-1-luiz.dentz@gmail.com>
-Sender: linux-bluetooth-owner@vger.kernel.org
-List-ID: <linux-bluetooth.vger.kernel.org>
-X-Mailing-List: linux-bluetooth@vger.kernel.org
-MIME-Version: 1.0
-Content-Type: text/plain; charset="utf-8"
-Content-Transfer-Encoding: 7bit
-
-From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
-
-This checks if BT_HS is enabled relecting it on MGMT_SETTING_HS instead
-of always reporting it as supported.
-
-Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
----
- net/bluetooth/mgmt.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
-index 5bbe71002fb9..5758ccb524ef 100644
---- a/net/bluetooth/mgmt.c
-+++ b/net/bluetooth/mgmt.c
-@@ -782,7 +782,8 @@ static u32 get_supported_settings(struct hci_dev *hdev)
- 
- 		if (lmp_ssp_capable(hdev)) {
- 			settings |= MGMT_SETTING_SSP;
--			settings |= MGMT_SETTING_HS;
-+			if (IS_ENABLED(CONFIG_BT_HS))
-+				settings |= MGMT_SETTING_HS;
- 		}
- 
- 		if (lmp_sc_capable(hdev))
-@@ -1815,6 +1816,10 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
- 
- 	bt_dev_dbg(hdev, "sock %p", sk);
- 
-+	if (!IS_ENABLED(CONFIG_BT_HS))
-+		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
-+				       MGMT_STATUS_NOT_SUPPORTED);
-+
- 	status = mgmt_bredr_support(hdev);
- 	if (status)
- 		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
--- 
-2.26.2
-
-
diff --git a/kernel.spec b/kernel.spec
index bcf56adc9..2bb43ba96 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -899,9 +899,6 @@ Patch118: arm64-rockchip-pinebookpro-add-fuel-gauge.patch
 # CVE-2020-16119 rhbz 1886374 1888083
 Patch119: CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch
 
-# CVE-2020-12351 CVE-2020-12352 rhbz 1886521 1888439 1886529 1888440
-Patch122: bluetooth_cves.patch
-
 # Surface Go series not booting regression fix (rhbz 1886249)
 # Also fixes some touchscreen regressions:
 # https://bugzilla.kernel.org/show_bug.cgi?id=209627
@@ -3024,6 +3021,9 @@ fi
 #
 #
 %changelog
+* Mon Oct 19 07:15:06 CDT 2020 Justin M. Forbes <jforbes@fedoraproject.org> - 5.8.16-200
+- Linux v5.8.16
+
 * Fri Oct 16 2020 Hans de Goede <hdegoede@redhat.com>
 - Fix Micrsoft Surface Go series boot regression (rhbz 1886249)