From: Greg Kroah-Hartman Date: Fri, 16 Oct 2020 05:48:32 +0000 (+0200) Subject: 5.9-stable patches X-Git-Tag: v5.9.1~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=adebf14b1dce2a4058881d3141b3f5a9279e32ce;p=thirdparty%2Fkernel%2Fstable-queue.git 5.9-stable patches added patches: bluetooth-a2mp-fix-not-initializing-all-members.patch bluetooth-l2cap-fix-calling-sk_filter-on-non-socket-based-channel.patch bluetooth-mgmt-fix-not-checking-if-bt_hs-is-enabled.patch --- diff --git a/queue-5.8/series b/queue-5.8/series new file mode 100644 index 00000000000..a65f1aa58f1 --- /dev/null +++ b/queue-5.8/series @@ -0,0 +1,3 @@ +bluetooth-a2mp-fix-not-initializing-all-members.patch +bluetooth-l2cap-fix-calling-sk_filter-on-non-socket-based-channel.patch +bluetooth-mgmt-fix-not-checking-if-bt_hs-is-enabled.patch diff --git a/queue-5.9/bluetooth-a2mp-fix-not-initializing-all-members.patch b/queue-5.9/bluetooth-a2mp-fix-not-initializing-all-members.patch new file mode 100644 index 00000000000..1bd92f4c186 --- /dev/null +++ b/queue-5.9/bluetooth-a2mp-fix-not-initializing-all-members.patch @@ -0,0 +1,120 @@ +From eddb7732119d53400f48a02536a84c509692faa8 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Thu, 6 Aug 2020 11:17:11 -0700 +Subject: Bluetooth: A2MP: Fix not initializing all members + +From: Luiz Augusto von Dentz + +commit eddb7732119d53400f48a02536a84c509692faa8 upstream. + +This fixes various places where a stack variable is used uninitialized. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/a2mp.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/a2mp.c ++++ b/net/bluetooth/a2mp.c +@@ -226,6 +226,9 @@ static int a2mp_discover_rsp(struct amp_ + struct a2mp_info_req req; + + found = true; ++ ++ memset(&req, 0, sizeof(req)); ++ + req.id = cl->id; + a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr), + sizeof(req), &req); +@@ -305,6 +308,8 @@ static int a2mp_getinfo_req(struct amp_m + if (!hdev || hdev->dev_type != HCI_AMP) { + struct a2mp_info_rsp rsp; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.id = req->id; + rsp.status = A2MP_STATUS_INVALID_CTRL_ID; + +@@ -348,6 +353,8 @@ static int a2mp_getinfo_rsp(struct amp_m + if (!ctrl) + return -ENOMEM; + ++ memset(&req, 0, sizeof(req)); ++ + req.id = rsp->id; + a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req), + &req); +@@ -376,6 +383,8 @@ static int a2mp_getampassoc_req(struct a + struct a2mp_amp_assoc_rsp rsp; + rsp.id = req->id; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + if (tmp) { + rsp.status = A2MP_STATUS_COLLISION_OCCURED; + amp_mgr_put(tmp); +@@ -464,7 +473,6 @@ static int a2mp_createphyslink_req(struc + struct a2mp_cmd *hdr) + { + struct a2mp_physlink_req *req = (void *) skb->data; +- + struct a2mp_physlink_rsp rsp; + struct hci_dev *hdev; + struct hci_conn *hcon; +@@ -475,6 +483,8 @@ static int a2mp_createphyslink_req(struc + + BT_DBG("local_id %d, remote_id %d", req->local_id, req->remote_id); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.local_id = req->remote_id; + rsp.remote_id = req->local_id; + +@@ -553,6 +563,8 @@ static int a2mp_discphyslink_req(struct + + BT_DBG("local_id %d remote_id %d", req->local_id, req->remote_id); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.local_id = req->remote_id; + rsp.remote_id = req->local_id; + rsp.status = A2MP_STATUS_SUCCESS; +@@ -675,6 +687,8 @@ static int a2mp_chan_recv_cb(struct l2ca + if (err) { + struct a2mp_cmd_rej rej; + ++ memset(&rej, 0, sizeof(rej)); ++ + rej.reason = cpu_to_le16(0); + hdr = (void *) skb->data; + +@@ -898,6 +912,8 @@ void a2mp_send_getinfo_rsp(struct hci_de + + BT_DBG("%s mgr %p", hdev->name, mgr); + ++ memset(&rsp, 0, sizeof(rsp)); ++ + rsp.id = hdev->id; + rsp.status = A2MP_STATUS_INVALID_CTRL_ID; + +@@ -995,6 +1011,8 @@ void a2mp_send_create_phy_link_rsp(struc + if (!mgr) + return; + ++ memset(&rsp, 0, sizeof(rsp)); ++ + hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT); + if (!hs_hcon) { + rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION; +@@ -1027,6 +1045,8 @@ void a2mp_discover_amp(struct l2cap_chan + + mgr->bredr_chan = chan; + ++ memset(&req, 0, sizeof(req)); ++ + req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU); + req.ext_feat = 0; + a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req); diff --git a/queue-5.9/bluetooth-l2cap-fix-calling-sk_filter-on-non-socket-based-channel.patch b/queue-5.9/bluetooth-l2cap-fix-calling-sk_filter-on-non-socket-based-channel.patch new file mode 100644 index 00000000000..55c76b6357f --- /dev/null +++ b/queue-5.9/bluetooth-l2cap-fix-calling-sk_filter-on-non-socket-based-channel.patch @@ -0,0 +1,81 @@ +From f19425641cb2572a33cb074d5e30283720bd4d22 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Thu, 6 Aug 2020 11:17:12 -0700 +Subject: Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel + +From: Luiz Augusto von Dentz + +commit f19425641cb2572a33cb074d5e30283720bd4d22 upstream. + +Only sockets will have the chan->data set to an actual sk, channels +like A2MP would have its own data which would likely cause a crash when +calling sk_filter, in order to fix this a new callback has been +introduced so channels can implement their own filtering if necessary. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/bluetooth/l2cap.h | 2 ++ + net/bluetooth/l2cap_core.c | 7 ++++--- + net/bluetooth/l2cap_sock.c | 14 ++++++++++++++ + 3 files changed, 20 insertions(+), 3 deletions(-) + +--- a/include/net/bluetooth/l2cap.h ++++ b/include/net/bluetooth/l2cap.h +@@ -665,6 +665,8 @@ struct l2cap_ops { + struct sk_buff *(*alloc_skb) (struct l2cap_chan *chan, + unsigned long hdr_len, + unsigned long len, int nb); ++ int (*filter) (struct l2cap_chan * chan, ++ struct sk_buff *skb); + }; + + struct l2cap_conn { +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -7301,9 +7301,10 @@ static int l2cap_data_rcv(struct l2cap_c + goto drop; + } + +- if ((chan->mode == L2CAP_MODE_ERTM || +- chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb)) +- goto drop; ++ if (chan->ops->filter) { ++ if (chan->ops->filter(chan, skb)) ++ goto drop; ++ } + + if (!control->sframe) { + int err; +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1663,6 +1663,19 @@ static void l2cap_sock_suspend_cb(struct + sk->sk_state_change(sk); + } + ++static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb) ++{ ++ struct sock *sk = chan->data; ++ ++ switch (chan->mode) { ++ case L2CAP_MODE_ERTM: ++ case L2CAP_MODE_STREAMING: ++ return sk_filter(sk, skb); ++ } ++ ++ return 0; ++} ++ + static const struct l2cap_ops l2cap_chan_ops = { + .name = "L2CAP Socket Interface", + .new_connection = l2cap_sock_new_connection_cb, +@@ -1678,6 +1691,7 @@ static const struct l2cap_ops l2cap_chan + .get_sndtimeo = l2cap_sock_get_sndtimeo_cb, + .get_peer_pid = l2cap_sock_get_peer_pid_cb, + .alloc_skb = l2cap_sock_alloc_skb_cb, ++ .filter = l2cap_sock_filter, + }; + + static void l2cap_sock_destruct(struct sock *sk) diff --git a/queue-5.9/bluetooth-mgmt-fix-not-checking-if-bt_hs-is-enabled.patch b/queue-5.9/bluetooth-mgmt-fix-not-checking-if-bt_hs-is-enabled.patch new file mode 100644 index 00000000000..ce2cb54b3c7 --- /dev/null +++ b/queue-5.9/bluetooth-mgmt-fix-not-checking-if-bt_hs-is-enabled.patch @@ -0,0 +1,43 @@ +From b560a208cda0297fef6ff85bbfd58a8f0a52a543 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Thu, 6 Aug 2020 11:17:14 -0700 +Subject: Bluetooth: MGMT: Fix not checking if BT_HS is enabled + +From: Luiz Augusto von Dentz + +commit b560a208cda0297fef6ff85bbfd58a8f0a52a543 upstream. + +This checks if BT_HS is enabled relecting it on MGMT_SETTING_HS instead +of always reporting it as supported. + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/mgmt.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -782,7 +782,8 @@ static u32 get_supported_settings(struct + + if (lmp_ssp_capable(hdev)) { + settings |= MGMT_SETTING_SSP; +- settings |= MGMT_SETTING_HS; ++ if (IS_ENABLED(CONFIG_BT_HS)) ++ settings |= MGMT_SETTING_HS; + } + + if (lmp_sc_capable(hdev)) +@@ -1815,6 +1816,10 @@ static int set_hs(struct sock *sk, struc + + bt_dev_dbg(hdev, "sock %p", sk); + ++ if (!IS_ENABLED(CONFIG_BT_HS)) ++ return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, ++ MGMT_STATUS_NOT_SUPPORTED); ++ + status = mgmt_bredr_support(hdev); + if (status) + return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); diff --git a/queue-5.9/series b/queue-5.9/series new file mode 100644 index 00000000000..a65f1aa58f1 --- /dev/null +++ b/queue-5.9/series @@ -0,0 +1,3 @@ +bluetooth-a2mp-fix-not-initializing-all-members.patch +bluetooth-l2cap-fix-calling-sk_filter-on-non-socket-based-channel.patch +bluetooth-mgmt-fix-not-checking-if-bt_hs-is-enabled.patch