From 18f88c87df0db1007223bd9121a4c6e3e0680dfc Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: Oct 15 2020 11:23:18 +0000 Subject: Merge branch 'cve/linux-4.12' into SLE15-SP1 Conflicts: series.conf --- diff --git a/patches.kabi/bluetooth-l2cap-filter-ops-kABI-workaround.patch b/patches.kabi/bluetooth-l2cap-filter-ops-kABI-workaround.patch new file mode 100644 index 0000000..f5a59d2 --- /dev/null +++ b/patches.kabi/bluetooth-l2cap-filter-ops-kABI-workaround.patch @@ -0,0 +1,68 @@ +From: Takashi Iwai +Subject: kABI workaround for bluetooth l2cap_ops filter addition +Patch-mainline: Never, kABI workaround for cve/linux-4.12 +References: CVE-2020-12351 bsc#1177724 + +The recent fix for adding a new field to struct l2cap_ops breaks kABI. +We may protect the new field with __GENKSYMS__, but this still needs +some check not to access the unexisting field in the old code. +Fix it by checking a new bit field in caps->flags additionally. + +Signed-off-by: Takashi Iwai + +--- + include/net/bluetooth/l2cap.h | 8 ++++++++ + net/bluetooth/l2cap_core.c | 4 +++- + net/bluetooth/l2cap_sock.c | 2 ++ + 3 files changed, 13 insertions(+), 1 deletion(-) + +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -623,8 +623,13 @@ struct l2cap_ops { + struct sk_buff *(*alloc_skb) (struct l2cap_chan *chan, + unsigned long hdr_len, + unsigned long len, int nb); ++#ifndef __GENKSYMS__ ++ /* XXX: kABI workaround for SLE15-SP2; for enabling this ops, ++ * you need to set FLAG_CHAN_OPS_SK_FILTER to chan->flags, too ++ */ + int (*filter) (struct l2cap_chan * chan, + struct sk_buff *skb); ++#endif + }; + + struct l2cap_conn { +@@ -730,6 +735,9 @@ enum { + FLAG_HOLD_HCI_CONN, + }; + ++/* XXX: a special flag for SLE15-SP2 kABI workaround */ ++#define FLAG_CHAN_OPS_SK_FILTER 30 ++ + /* Lock nesting levels for L2CAP channels. We need these because lockdep + * otherwise considers all channels equal and will e.g. complain about a + * connection oriented channel triggering SMP procedures or a listening +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6701,7 +6701,9 @@ static int l2cap_data_rcv(struct l2cap_c + goto drop; + } + +- if (chan->ops->filter) { ++ /* XXX: kABI workaround for SLE15-SP2; checking the special flag */ ++ if (test_bit(FLAG_CHAN_OPS_SK_FILTER, &chan->flags) && ++ chan->ops->filter) { + if (chan->ops->filter(chan, skb)) + goto drop; + } +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1602,6 +1602,8 @@ static void l2cap_sock_init(struct sock + + chan->data = sk; + chan->ops = &l2cap_chan_ops; ++ /* XXX: a special flag for SLE15-SP2 kABI workaround */ ++ set_bit(FLAG_CHAN_OPS_SK_FILTER, &chan->flags); + } + + static struct proto l2cap_proto = { diff --git a/patches.suse/Bluetooth-A2MP-Fix-not-initializing-all-members.patch b/patches.suse/Bluetooth-A2MP-Fix-not-initializing-all-members.patch new file mode 100644 index 0000000..a997a7e --- /dev/null +++ b/patches.suse/Bluetooth-A2MP-Fix-not-initializing-all-members.patch @@ -0,0 +1,125 @@ +From eddb7732119d53400f48a02536a84c509692faa8 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Thu, 6 Aug 2020 11:17:11 -0700 +Subject: [PATCH] Bluetooth: A2MP: Fix not initializing all members +Git-commit: eddb7732119d53400f48a02536a84c509692faa8 +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git +Patch-mainline: Queued in subsystem maintainer repository +References: CVE-2020-12352 bsc#1177725 + +This fixes various places where a stack variable is used uninitialized. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + net/bluetooth/a2mp.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c +index 26526be579c7..da7fd7c8c2dc 100644 +--- a/net/bluetooth/a2mp.c ++++ b/net/bluetooth/a2mp.c +@@ -226,6 +226,9 @@ static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_info_req req; + + found = true; ++ ++ memset(&req, 0, sizeof(req)); ++ + req.id = cl->id; + a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr), + sizeof(req), &req); +@@ -305,6 +308,8 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb, + if (!hdev || hdev->dev_type != HCI_AMP) { + struct a2mp_info_rsp rsp; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.id = req->id; + rsp.status = A2MP_STATUS_INVALID_CTRL_ID; + +@@ -348,6 +353,8 @@ static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb, + if (!ctrl) + return -ENOMEM; + ++ memset(&req, 0, sizeof(req)); ++ + req.id = rsp->id; + a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req), + &req); +@@ -376,6 +383,8 @@ static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_amp_assoc_rsp rsp; + rsp.id = req->id; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + if (tmp) { + rsp.status = A2MP_STATUS_COLLISION_OCCURED; + amp_mgr_put(tmp); +@@ -464,7 +473,6 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + struct a2mp_cmd *hdr) + { + struct a2mp_physlink_req *req = (void *) skb->data; +- + struct a2mp_physlink_rsp rsp; + struct hci_dev *hdev; + struct hci_conn *hcon; +@@ -475,6 +483,8 @@ static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + + BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.local_id = req->remote_id; + rsp.remote_id = req->local_id; + +@@ -553,6 +563,8 @@ static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb, + + BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.local_id = req->remote_id; + rsp.remote_id = req->local_id; + rsp.status = A2MP_STATUS_SUCCESS; +@@ -675,6 +687,8 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) + if (err) { + struct a2mp_cmd_rej rej; + ++ memset(&rej, 0, sizeof(rej)); ++ + rej.reason = cpu_to_le16(0); + hdr = (void *) skb->data; + +@@ -898,6 +912,8 @@ void a2mp_send_getinfo_rsp(struct hci_dev *hdev) + + BT_DBG("%s mgr %p", hdev->name, mgr); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.id = hdev->id; + rsp.status = A2MP_STATUS_INVALID_CTRL_ID; + +@@ -995,6 +1011,8 @@ void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status) + if (!mgr) + return; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT); + if (!hs_hcon) { + rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; +@@ -1027,6 +1045,8 @@ void a2mp_discover_amp(struct l2cap_chan *chan) + + mgr->bredr_chan = chan; + ++ memset(&req, 0, sizeof(req)); ++ + req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); + req.ext_feat = 0; + a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req); +-- +2.16.4 + diff --git a/patches.suse/Bluetooth-L2CAP-Fix-calling-sk_filter-on-non-socket-.patch b/patches.suse/Bluetooth-L2CAP-Fix-calling-sk_filter-on-non-socket-.patch new file mode 100644 index 0000000..786b769 --- /dev/null +++ b/patches.suse/Bluetooth-L2CAP-Fix-calling-sk_filter-on-non-socket-.patch @@ -0,0 +1,82 @@ +From f19425641cb2572a33cb074d5e30283720bd4d22 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Thu, 6 Aug 2020 11:17:12 -0700 +Subject: [PATCH] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based + channel +Git-commit: f19425641cb2572a33cb074d5e30283720bd4d22 +Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git +Patch-mainline: Queued in subsystem maintainer repository +References: CVE-2020-12351 bsc#1177724 + +Only sockets will have the chan->data set to an actual sk, channels +like A2MP would have its own data which would likely cause a crash when +calling sk_filter, in order to fix this a new callback has been +introduced so channels can implement their own filtering if necessary. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Acked-by: Takashi Iwai + +--- + include/net/bluetooth/l2cap.h | 2 ++ + net/bluetooth/l2cap_core.c | 7 ++++--- + net/bluetooth/l2cap_sock.c | 14 ++++++++++++++ + 3 files changed, 20 insertions(+), 3 deletions(-) + +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -623,6 +623,8 @@ struct l2cap_ops { + struct sk_buff *(*alloc_skb) (struct l2cap_chan *chan, + unsigned long hdr_len, + unsigned long len, int nb); ++ int (*filter) (struct l2cap_chan * chan, ++ struct sk_buff *skb); + }; + + struct l2cap_conn { +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6701,9 +6701,10 @@ static int l2cap_data_rcv(struct l2cap_c + goto drop; + } + +- if ((chan->mode == L2CAP_MODE_ERTM || +- chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb)) +- goto drop; ++ if (chan->ops->filter) { ++ if (chan->ops->filter(chan, skb)) ++ goto drop; ++ } + + if (!control->sframe) { + int err; +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1479,6 +1479,19 @@ static void l2cap_sock_suspend_cb(struct + sk->sk_state_change(sk); + } + ++static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) ++{ ++ struct sock *sk = chan->data; ++ ++ switch (chan->mode) { ++ case L2CAP_MODE_ERTM: ++ case L2CAP_MODE_STREAMING: ++ return sk_filter(sk, skb); ++ } ++ ++ return 0; ++} ++ + static const struct l2cap_ops l2cap_chan_ops = { + .name = "L2CAP Socket Interface", + .new_connection = l2cap_sock_new_connection_cb, +@@ -1493,6 +1506,7 @@ static const struct l2cap_ops l2cap_chan + .set_shutdown = l2cap_sock_set_shutdown_cb, + .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, + .alloc_skb = l2cap_sock_alloc_skb_cb, ++ .filter = l2cap_sock_filter, + }; + + static void l2cap_sock_destruct(struct sock *sk) diff --git a/series.conf b/series.conf index 6775c2a..63a44a6 100644 --- a/series.conf +++ b/series.conf @@ -55808,6 +55808,10 @@ patches.suse/0005-MODSIGN-Allow-the-db-UEFI-variable-to-be-suppressed.patch patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch + # bluetooth/bluetooth-next + patches.suse/Bluetooth-A2MP-Fix-not-initializing-all-members.patch + patches.suse/Bluetooth-L2CAP-Fix-calling-sk_filter-on-non-socket-.patch + # out-of-tree patches patches.suse/net-mvpp2-fix-condition-for-setting-up-link-interrup.patch patches.suse/cifs-handle-netapp-error-codes.patch @@ -56690,6 +56694,7 @@ patches.kabi/kabi-hide-new-parameter-of-ip6_dst_lookup_flow.patch patches.kabi/kabi-mask-changes-to-struct-ipv6_stub.patch patches.kabi/futex-Fix-inode-life-time-issue.patch + patches.kabi/bluetooth-l2cap-filter-ops-kABI-workaround.patch ######################################################## # You'd better have a good reason for adding a patch