redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/drivers
History
Vladis Dronov b36a1552d7 Bluetooth: hci_uart: check for missing tty operations 
Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset()
functions which are called by the certain HCI UART protocols (hci_ath,
hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control()
or directly. This leads to an execution at NULL and can be triggered by
an unprivileged user. Fix this by adding a helper function and a check
for the missing tty operations in the protocols code.

This fixes CVE-2019-10207. The Fixes: lines list commits where calls to
tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART
protocols.

Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50
Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org # v2.6.36+
Fixes: b3190df628 ("Bluetooth: Support for Atheros AR300x serial chip")
Fixes: 118612fb91 ("Bluetooth: hci_bcm: Add suspend/resume PM functions")
Fixes: ff2895592f ("Bluetooth: hci_intel: Add Intel baudrate configuration support")
Fixes: 162f812f23 ("Bluetooth: hci_uart: Add Marvell support")
Fixes: fa9ad876b8 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990")
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Reviewed-by: Yu-Chen, Cho <acho@suse.com>
Tested-by: Yu-Chen, Cho <acho@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 		2019-07-31 13:17:33 -07:00
..
accessibility
…
acpi libnvdimm fixes v5.3-rc2 2019-07-27 08:25:51 -07:00
amba Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
android binder: prevent transactions to context manager from its own process. 2019-07-24 11:02:28 +02:00
ata ata: libahci_platform: remove redundant dev_err message 2019-07-16 08:27:09 -06:00
atm atm: idt77252: Remove call to memset after dma_alloc_coherent 2019-07-15 11:06:27 -07:00
auxdisplay It's been a relatively busy cycle for docs: 2019-07-09 12:34:26 -07:00
base Char/Misc driver fixes for 5.3-rc2 2019-07-28 10:26:10 -07:00
bcma
…
block for-linus-20190726 2019-07-26 10:32:12 -07:00
bluetooth Bluetooth: hci_uart: check for missing tty operations 2019-07-31 13:17:33 -07:00
bus ARM: SoC-related driver updates 2019-07-19 17:13:56 -07:00
cdrom
…
char One necessary fix for an uninitialized variable in the new IPMB driver. 2019-07-31 10:13:00 -07:00
clk This round of clk driver and framework updates is heavy on the driver update 2019-07-17 10:07:48 -07:00
clocksource clocksource/drivers/npcm: Fix misuse of GENMASK macro 2019-07-10 11:05:26 +02:00
connector connector: remove redundant input callback from cn_dev 2019-07-21 13:31:14 -07:00
counter Staging / IIO driver update for 5.3-rc1 2019-07-11 15:36:02 -07:00
cpufreq cpufreq/pasemi: fix use-after-free in pas_cpufreq_cpu_init() 2019-07-23 09:49:10 +02:00
cpuidle Merge branch 'pm-cpufreq' 2019-07-18 09:49:30 +02:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2019-07-19 12:23:37 -07:00
dax Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
dca
…
devfreq
…
dio
…
dma dmaengine updates for v5.3-rc1 2019-07-17 09:55:43 -07:00
dma-buf Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
edac
…
eisa
…
extcon
…
firewire firewire: mark expected switch fall-throughs 2019-07-25 20:09:37 -05:00
firmware Merge branch 'for-linus-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft 2019-07-26 09:43:43 -07:00
fpga fpga-manager: altera-ps-spi: Fix build error 2019-07-24 11:29:41 +02:00
fsi
…
gnss
…
gpio GPIO fixes for the v5.3 merge window: 2019-07-17 13:05:21 -07:00
gpu HMM patches for 5.3-rc 2019-07-30 12:54:44 -07:00
hid Linux 5.2 2019-07-15 09:42:32 -07:00
hsi
…
hv proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
hwmon hwmon: (nct6775) Fix register address and added missed tolerance for nct6106 2019-07-21 19:18:45 -07:00
hwspinlock
…
hwtracing coresight: Make the coresight_device_fwnode_match declaration's fwnode parameter const 2019-07-12 14:42:05 -07:00
i2c docs: fix broken doc references due to renames 2019-07-17 06:57:51 -03:00
i3c * Drop support for 10-bit I2C addresses 2019-07-09 09:04:31 -07:00
ide It's been a relatively busy cycle for docs: 2019-07-09 12:34:26 -07:00
idle
…
iio Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
infiniband IB/mlx5: Fix RSS Toeplitz setup to be aligned with the HW specification 2019-07-25 11:45:48 -03:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2019-07-20 12:22:30 -07:00
interconnect
…
iommu virtio, vhost: bugfixes 2019-07-29 11:34:12 -07:00
ipack TTY / Serial driver updates for 5.3-rc1 2019-07-11 15:38:21 -07:00
irqchip irqchip/gic-v3-its: Fix misuse of GENMASK macro 2019-07-10 11:04:17 +02:00
isdn ISDN: hfcsusb: checking idx of ep configuration 2019-07-15 11:10:31 -07:00
leds LED updates for 5.3-rc1 2019-07-09 08:59:39 -07:00
lightnvm
…
macintosh powerpc updates for 5.3 2019-07-13 16:08:36 -07:00
mailbox - stm32: race fix by adding a spinlock 2019-07-14 16:36:51 -07:00
mcb
…
md for-linus-20190726 2019-07-26 10:32:12 -07:00
media media updates for v5.3-rc1 2019-07-22 09:01:47 -07:00
memory Kbuild updates for v5.3 (2nd) 2019-07-20 09:34:55 -07:00
memstick MMC core: 2019-07-11 18:11:21 -07:00
message SCSI misc on 20190709 2019-07-11 15:14:01 -07:00
mfd - Core Frameworks 2019-07-15 20:18:40 -07:00
misc eeprom: make older eeprom drivers select NVMEM_SYSFS 2019-07-25 14:39:51 +02:00
mmc MMC core: 2019-07-11 18:11:21 -07:00
mtd mtd: onenand_base: Mark expected switch fall-through 2019-07-25 20:09:54 -05:00
mux
…
net Wimplicit-fallthrough patches for 5.3-rc2 2019-07-27 11:04:18 -07:00
nfc nfc: st-nci: remove redundant assignment to variable r 2019-07-02 12:00:50 -07:00
ntb New feature to add support for NTB virtual MSI interrupts, the ability 2019-07-21 09:46:59 -07:00
nubus
…
nvdimm libnvdimm fixes v5.3-rc2 2019-07-27 08:25:51 -07:00
nvme Revert "nvme-pci: don't create a read hctx mapping without read queues" 2019-07-23 17:47:02 +02:00
nvmem Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
of virtio, vhost: fixes, features, performance 2019-07-17 11:26:09 -07:00
opp pci-v5.3-changes 2019-07-15 20:44:49 -07:00
oprofile vfs: Convert oprofilefs to use the new mount API 2019-07-04 22:01:59 -04:00
parisc
…
parport It's been a relatively busy cycle for docs: 2019-07-09 12:34:26 -07:00
pci New feature to add support for NTB virtual MSI interrupts, the ability 2019-07-21 09:46:59 -07:00
pcmcia It's been a relatively busy cycle for docs: 2019-07-09 12:34:26 -07:00
perf docs: perf: move to the admin-guide 2019-07-15 09:20:27 -03:00
phy phy: for 5.3 2019-07-01 15:04:59 +02:00
pinctrl This is the bulk of pin control changes for the v5.3 kernel 2019-07-13 15:02:27 -07:00
platform platform/x86: pcengines-apuv2: use KEY_RESTART for front button 2019-07-29 18:24:59 +03:00
pnp docs: driver-api: add a series of orphaned documents 2019-07-15 11:03:02 -03:00
power power supply and reset changes for the v5.3 series 2019-07-15 21:06:15 -07:00
powercap powercap: Invoke powercap_init() and rapl_init() earlier 2019-07-22 11:23:00 +02:00
pps drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl 2019-07-16 19:23:24 -07:00
ps3
…
ptp
…
pwm pwm: Changes for v5.3-rc1 2019-07-09 08:57:45 -07:00
rapidio Merge branch 'akpm' (patches from Andrew) 2019-07-17 08:58:04 -07:00
ras
…
regulator - Core Frameworks 2019-07-15 20:18:40 -07:00
remoteproc remoteproc updates for v5.3 2019-07-17 11:44:41 -07:00
reset ARM: SoC-related driver updates 2019-07-19 17:13:56 -07:00
rpmsg
…
rtc RTC for 5.3 2019-07-17 10:03:50 -07:00
s390 virtio/s390: fix race on airq_areas[] 2019-07-26 13:36:18 +02:00
sbus
…
scsi SCSI fixes on 20190726 2019-07-26 14:20:28 -07:00
sfi
…
sh
…
siox
…
slimbus
…
sn
…
soc Merge branch 'pdf_fixes_v1' of https://git.linuxtv.org/mchehab/experimental into mauro 2019-07-22 13:51:20 -06:00
soundwire soundwire updates for v5.3-rc1 2019-07-05 08:15:08 +02:00
spi Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
spmi
…
ssb
…
staging docs conversion for v5.3-rc1 2019-07-16 12:21:41 -07:00
target scsi: target: cxgbit: add support for IEEE_8021QAZ_APP_SEL_STREAM selector 2019-07-22 17:04:20 -04:00
tc
…
tee
…
thermal int340X/processor_thermal_device: Fix proc_thermal_rapl_remove() 2019-07-23 09:36:07 +02:00
thunderbolt Driver Core and debugfs changes for 5.3-rc1 2019-07-12 12:24:03 -07:00
tty TTY fixes for 5.3-rc2 2019-07-28 10:18:33 -07:00
uio
…
usb xhci: Fix crash if scatter gather is used with Immediate Data Transfer (IDT). 2019-07-25 11:26:42 +02:00
uwb
…
vfio VFIO updates for v5.3-rc1 2019-07-17 11:23:13 -07:00
vhost vhost: disable metadata prefetch optimization 2019-07-26 07:49:29 -04:00
video - New Functionality 2019-07-16 09:25:04 -07:00
virt
…
virtio Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
visorbus
…
vlynq
…
vme
…
w1 docs: driver-api: add a series of orphaned documents 2019-07-15 11:03:02 -03:00
watchdog watchdog: digicolor_wdt: Remove unused variable in dc_wdt_probe 2019-07-15 08:49:11 +02:00
xen xen: fixes and features for 5.3-rc1 2019-07-19 11:41:26 -07:00
zorro
…
Kconfig
…
Makefile
…