diff options
| -rw-r--r-- | bluetooth_cves.patch | 320 | ||||
| -rw-r--r-- | kernel.spec | 10 | ||||
| -rw-r--r-- | sources | 2 |
3 files changed, 6 insertions, 326 deletions
diff --git a/bluetooth_cves.patch b/bluetooth_cves.patch deleted file mode 100644 index 129b0d055..000000000 --- a/bluetooth_cves.patch +++ /dev/null @@ -1,320 +0,0 @@ -From MAILER-DAEMON Thu Oct 15 15:17:31 2020 -From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> -To: linux-bluetooth@vger.kernel.org -Subject: [PATCH 1/4] Bluetooth: A2MP: Fix not initializing all members -Date: Thu, 06 Aug 2020 11:17:11 -0700 -Message-Id: <20200806181714.3216076-1-luiz.dentz@gmail.com> -Sender: linux-bluetooth-owner@vger.kernel.org -List-ID: <linux-bluetooth.vger.kernel.org> -X-Mailing-List: linux-bluetooth@vger.kernel.org -MIME-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 7bit - -From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> - -This fixes various places where a stack variable is used uninitialized. - -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> ---- - net/bluetooth/a2mp.c | 22 +++++++++++++++++++++- - 1 file changed, 21 insertions(+), 1 deletion(-) - -diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c -index 26526be579c7..da7fd7c8c2dc 100644 ---- a/net/bluetooth/a2mp.c -+++ b/net/bluetooth/a2mp.c -@@ -226,6 +226,9 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb, - struct a2mp_info_req req; - - found = true; -+ -+ memset(&req, 0, sizeof(req)); -+ - req.id = cl->id; - a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr), - sizeof(req), &req); -@@ -305,6 +308,8 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb, - if (!hdev || hdev->dev_type != HCI_AMP) { - struct a2mp_info_rsp rsp; - -+ memset(&rsp, 0, sizeof(rsp)); -+ - rsp.id = req->id; - rsp.status = A2MP_STATUS_INVALID_CTRL_ID; - -@@ -348,6 +353,8 @@ static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb, - if (!ctrl) - return -ENOMEM; - -+ memset(&req, 0, sizeof(req)); -+ - req.id = rsp->id; - a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req), - &req); -@@ -376,6 +383,8 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb, - struct a2mp_amp_assoc_rsp rsp; - rsp.id = req->id; - -+ memset(&rsp, 0, sizeof(rsp)); -+ - if (tmp) { - rsp.status = A2MP_STATUS_COLLISION_OCCURED; - amp_mgr_put(tmp); -@@ -464,7 +473,6 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, - struct a2mp_cmd *hdr) - { - struct a2mp_physlink_req *req = (void *) skb->data; -- - struct a2mp_physlink_rsp rsp; - struct hci_dev *hdev; - struct hci_conn *hcon; -@@ -475,6 +483,8 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, - - BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id); - -+ memset(&rsp, 0, sizeof(rsp)); -+ - rsp.local_id = req->remote_id; - rsp.remote_id = req->local_id; - -@@ -553,6 +563,8 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, - - BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id); - -+ memset(&rsp, 0, sizeof(rsp)); -+ - rsp.local_id = req->remote_id; - rsp.remote_id = req->local_id; - rsp.status = A2MP_STATUS_SUCCESS; -@@ -675,6 +687,8 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) - if (err) { - struct a2mp_cmd_rej rej; - -+ memset(&rej, 0, sizeof(rej)); -+ - rej.reason = cpu_to_le16(0); - hdr = (void *) skb->data; - -@@ -898,6 +912,8 @@ void a2mp_send_getinfo_rsp(struct hci_dev *hdev) - - BT_DBG("%s mgr %p", hdev->name, mgr); - -+ memset(&rsp, 0, sizeof(rsp)); -+ - rsp.id = hdev->id; - rsp.status = A2MP_STATUS_INVALID_CTRL_ID; - -@@ -995,6 +1011,8 @@ void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status) - if (!mgr) - return; - -+ memset(&rsp, 0, sizeof(rsp)); -+ - hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT); - if (!hs_hcon) { - rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; -@@ -1027,6 +1045,8 @@ void a2mp_discover_amp(struct l2cap_chan *chan) - - mgr->bredr_chan = chan; - -+ memset(&req, 0, sizeof(req)); -+ - req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); - req.ext_feat = 0; - a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req); --- -2.26.2 - - -From MAILER-DAEMON Thu Oct 15 15:17:31 2020 -From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> -To: linux-bluetooth@vger.kernel.org -Subject: [PATCH 2/4] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel -Date: Thu, 06 Aug 2020 11:17:12 -0700 -Message-Id: <20200806181714.3216076-2-luiz.dentz@gmail.com> -In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com> -References: <20200806181714.3216076-1-luiz.dentz@gmail.com> -Sender: linux-bluetooth-owner@vger.kernel.org -List-ID: <linux-bluetooth.vger.kernel.org> -X-Mailing-List: linux-bluetooth@vger.kernel.org -MIME-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 7bit - -From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> - -Only sockets will have the chan->data set to an actual sk, channels -like A2MP would have its own data which would likely cause a crash when -calling sk_filter, in order to fix this a new callback has been -introduced so channels can implement their own filtering if necessary. - -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> ---- - include/net/bluetooth/l2cap.h | 2 ++ - net/bluetooth/l2cap_core.c | 7 ++++--- - net/bluetooth/l2cap_sock.c | 14 ++++++++++++++ - 3 files changed, 20 insertions(+), 3 deletions(-) - -diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h -index bc5e9fbc3853..61800a7b6192 100644 ---- a/include/net/bluetooth/l2cap.h -+++ b/include/net/bluetooth/l2cap.h -@@ -666,6 +666,8 @@ struct l2cap_ops { - struct sk_buff *(*alloc_skb) (struct l2cap_chan *chan, - unsigned long hdr_len, - unsigned long len, int nb); -+ int (*filter) (struct l2cap_chan * chan, -+ struct sk_buff *skb); - }; - - struct l2cap_conn { -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index a4458c07b5e5..4a6b5e40e5e4 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -7301,9 +7301,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) - goto drop; - } - -- if ((chan->mode == L2CAP_MODE_ERTM || -- chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb)) -- goto drop; -+ if (chan->ops->filter) { -+ if (chan->ops->filter(chan, skb)) -+ goto drop; -+ } - - if (!control->sframe) { - int err; -diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c -index e1a3e66b1754..79b4c01c515b 100644 ---- a/net/bluetooth/l2cap_sock.c -+++ b/net/bluetooth/l2cap_sock.c -@@ -1663,6 +1663,19 @@ static void l2cap_sock_suspend_cb(struct l2cap_chan *chan) - sk->sk_state_change(sk); - } - -+static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) -+{ -+ struct sock *sk = chan->data; -+ -+ switch (chan->mode) { -+ case L2CAP_MODE_ERTM: -+ case L2CAP_MODE_STREAMING: -+ return sk_filter(sk, skb); -+ } -+ -+ return 0; -+} -+ - static const struct l2cap_ops l2cap_chan_ops = { - .name = "L2CAP Socket Interface", - .new_connection = l2cap_sock_new_connection_cb, -@@ -1678,6 +1691,7 @@ static const struct l2cap_ops l2cap_chan_ops = { - .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, - .get_peer_pid = l2cap_sock_get_peer_pid_cb, - .alloc_skb = l2cap_sock_alloc_skb_cb, -+ .filter = l2cap_sock_filter, - }; - - static void l2cap_sock_destruct(struct sock *sk) --- -2.26.2 - - -From MAILER-DAEMON Thu Oct 15 15:17:31 2020 -From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> -To: linux-bluetooth@vger.kernel.org -Subject: [PATCH 3/4] Bluetooth: Disable High Speed by default -Date: Thu, 06 Aug 2020 11:17:13 -0700 -Message-Id: <20200806181714.3216076-3-luiz.dentz@gmail.com> -In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com> -References: <20200806181714.3216076-1-luiz.dentz@gmail.com> -Sender: linux-bluetooth-owner@vger.kernel.org -List-ID: <linux-bluetooth.vger.kernel.org> -X-Mailing-List: linux-bluetooth@vger.kernel.org -MIME-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 7bit - -From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> - -Bluetooth High Speed requires hardware support which is very uncommon -nowadays since HS has not pickup interest by the industry. - -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> ---- - net/bluetooth/Kconfig | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig -index e2497d764e97..64e669acd42f 100644 ---- a/net/bluetooth/Kconfig -+++ b/net/bluetooth/Kconfig -@@ -64,7 +64,6 @@ source "net/bluetooth/hidp/Kconfig" - config BT_HS - bool "Bluetooth High Speed (HS) features" - depends on BT_BREDR -- default y - help - Bluetooth High Speed includes support for off-loading - Bluetooth connections via 802.11 (wifi) physical layer --- -2.26.2 - - -From MAILER-DAEMON Thu Oct 15 15:17:31 2020 -From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> -To: linux-bluetooth@vger.kernel.org -Subject: [PATCH 4/4] Bluetooth: MGMT: Fix not checking if BT_HS is enabled -Date: Thu, 06 Aug 2020 11:17:14 -0700 -Message-Id: <20200806181714.3216076-4-luiz.dentz@gmail.com> -In-Reply-To: <20200806181714.3216076-1-luiz.dentz@gmail.com> -References: <20200806181714.3216076-1-luiz.dentz@gmail.com> -Sender: linux-bluetooth-owner@vger.kernel.org -List-ID: <linux-bluetooth.vger.kernel.org> -X-Mailing-List: linux-bluetooth@vger.kernel.org -MIME-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 7bit - -From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> - -This checks if BT_HS is enabled relecting it on MGMT_SETTING_HS instead -of always reporting it as supported. - -Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> ---- - net/bluetooth/mgmt.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index 5bbe71002fb9..5758ccb524ef 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -782,7 +782,8 @@ static u32 get_supported_settings(struct hci_dev *hdev) - - if (lmp_ssp_capable(hdev)) { - settings |= MGMT_SETTING_SSP; -- settings |= MGMT_SETTING_HS; -+ if (IS_ENABLED(CONFIG_BT_HS)) -+ settings |= MGMT_SETTING_HS; - } - - if (lmp_sc_capable(hdev)) -@@ -1815,6 +1816,10 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) - - bt_dev_dbg(hdev, "sock %p", sk); - -+ if (!IS_ENABLED(CONFIG_BT_HS)) -+ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, -+ MGMT_STATUS_NOT_SUPPORTED); -+ - status = mgmt_bredr_support(hdev); - if (status) - return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); --- -2.26.2 - - diff --git a/kernel.spec b/kernel.spec index a435cabb7..43bde732f 100644 --- a/kernel.spec +++ b/kernel.spec @@ -80,7 +80,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 301 +%global baserelease 300 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -92,7 +92,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 15 +%define stable_update 16 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -891,9 +891,6 @@ Patch120: iommu-tegra-smmu-Fix-TLB-line-for-Tegra210.patch # CVE-2020-16119 rhbz 1886374 1888083 Patch121: CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch -# CVE-2020-12351 CVE-2020-12352 rhbz 1886521 1888439 1886529 1888440 -Patch122: bluetooth_cves.patch - # Surface Go series not booting regression fix (rhbz 1886249) # Also fixes some touchscreen regressions: # https://bugzilla.kernel.org/show_bug.cgi?id=209627 @@ -3013,6 +3010,9 @@ fi # # %changelog +* Mon Oct 19 07:15:01 CDT 2020 Justin M. Forbes <jforbes@fedoraproject.org> - 5.8.16-300 +- Linux v5.8.16 + * Fri Oct 16 2020 Hans de Goede <hdegoede@redhat.com> - Fix Micrsoft Surface Go series boot regression (rhbz 1886249) @@ -1,2 +1,2 @@ SHA512 (linux-5.8.tar.xz) = 19c8694bda4533464877e2d976aca95f48c2c40c11efcc1dce0ca91cc5f9826110e277c7de2a49ff99af8ae1c76e275b7c463abf71fbf410956d63066dc4ee53 -SHA512 (patch-5.8.15.xz) = 885f25aae3f4598ccee765f3ecaf68a6694041c5540c212d5782560f9f2abe581737033cc9e9f16a24b999eb6f30a5bf8ed8f9a975e6fd8ac8649a0e84ddbae9 +SHA512 (patch-5.8.16.xz) = b9f00c9aa0998e1db72ef2f3301c0082ec21e6d439394ea61876312634713ece2ca9ecce70a00af0c618dc6acbae4efb7a1b75df4d4564a672e6b8439ef13f97 |