Blame SOURCES/CVE-2021-32399.patch

443f6a
From: Artem Savkov <asavkov@redhat.com>
443f6a
Subject: [RHEL-7.9 CVE-2021-32399 KPATCH] bluetooth: eliminate the potential race condition when removing the HCI controller
443f6a
Date: Wed,  7 Jul 2021 17:13:32 +0200
443f6a
443f6a
Kernels:
443f6a
3.10.0-1160.el7
443f6a
3.10.0-1160.2.1.el7
443f6a
3.10.0-1160.2.2.el7
443f6a
3.10.0-1160.6.1.el7
443f6a
3.10.0-1160.11.1.el7
443f6a
3.10.0-1160.15.2.el7
443f6a
3.10.0-1160.21.1.el7
443f6a
3.10.0-1160.24.1.el7
443f6a
3.10.0-1160.25.1.el7
443f6a
3.10.0-1160.31.1.el7
443f6a
443f6a
Changes since last build:
443f6a
[x86_64]:
443f6a
hci_request.o: changed function: hci_req_sync
443f6a
443f6a
[ppc64le]:
443f6a
hci_request.o: changed function: bg_scan_update
443f6a
hci_request.o: changed function: connectable_update_work
443f6a
hci_request.o: changed function: discov_off
443f6a
hci_request.o: changed function: discov_update
443f6a
hci_request.o: changed function: discoverable_update_work
443f6a
hci_request.o: changed function: hci_req_sync
443f6a
hci_request.o: changed function: le_scan_disable_work
443f6a
hci_request.o: changed function: le_scan_restart_work
443f6a
hci_request.o: changed function: scan_update_work
443f6a
443f6a
---------------------------
443f6a
443f6a
Kernels:
443f6a
3.10.0-1160.el7
443f6a
3.10.0-1160.2.1.el7
443f6a
3.10.0-1160.2.2.el7
443f6a
3.10.0-1160.6.1.el7
443f6a
3.10.0-1160.11.1.el7
443f6a
3.10.0-1160.15.2.el7
443f6a
3.10.0-1160.21.1.el7
443f6a
3.10.0-1160.24.1.el7
443f6a
3.10.0-1160.25.1.el7
443f6a
3.10.0-1160.31.1.el7
443f6a
3.10.0-1160.36.2.el7
443f6a
443f6a
Modifications: none
443f6a
Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-7/-/merge_requests/171
443f6a
443f6a
commit 168b363c94eac82c2e3531bd2ae9dfa2f369d4be
443f6a
Author: Gopal Tiwari <gtiwari@redhat.com>
443f6a
Date:   Mon Jun 14 13:04:00 2021 +0530
443f6a
443f6a
    bluetooth: eliminate the potential race condition when removing the HCI controller
443f6a
443f6a
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1971457
443f6a
443f6a
    Upstream: merged.
443f6a
443f6a
    Testing: Sanity_only.
443f6a
443f6a
    commit e2cb6b891ad2b8caa9131e3be70f45243df82a80
443f6a
    Author: Lin Ma <linma@zju.edu.cn>
443f6a
    Date:   Mon Apr 12 19:17:57 2021 +0800
443f6a
443f6a
        bluetooth: eliminate the potential race condition when removing the HCI controller
443f6a
443f6a
        There is a possible race condition vulnerability between issuing a HCI
443f6a
        command and removing the cont.  Specifically, functions hci_req_sync()
443f6a
        and hci_dev_do_close() can race each other like below:
443f6a
443f6a
        thread-A in hci_req_sync()      |   thread-B in hci_dev_do_close()
443f6a
                                        |   hci_req_sync_lock(hdev);
443f6a
        test_bit(HCI_UP, &hdev->flags); |
443f6a
        ...                             |   test_and_clear_bit(HCI_UP, &hdev->flags)
443f6a
        hci_req_sync_lock(hdev);        |
443f6a
                                        |
443f6a
        In this commit we alter the sequence in function hci_req_sync(). Hence,
443f6a
        the thread-A cannot issue th.
443f6a
443f6a
        Signed-off-by: Lin Ma <linma@zju.edu.cn>
443f6a
        Cc: Marcel Holtmann <marcel@holtmann.org>
443f6a
        Fixes: 7c6a329e4447 ("[Bluetooth] Fix regression from using default link policy")
443f6a
        Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
443f6a
443f6a
    Signed-off-by: Gopal Tiwari <gtiwari@redhat.com>
443f6a
443f6a
Signed-off-by: Artem Savkov <asavkov@redhat.com>
443f6a
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
443f6a
Acked-by: Yannick Cote <ycote@redhat.com>
443f6a
---
443f6a
 net/bluetooth/hci_request.c | 12 ++++++++----
443f6a
 1 file changed, 8 insertions(+), 4 deletions(-)
443f6a
443f6a
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
443f6a
index 1015d9c8d97dd..9e25e77042503 100644
443f6a
--- a/net/bluetooth/hci_request.c
443f6a
+++ b/net/bluetooth/hci_request.c
443f6a
@@ -275,12 +275,16 @@ int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
443f6a
 {
443f6a
 	int ret;
443f6a
 
443f6a
-	if (!test_bit(HCI_UP, &hdev->flags))
443f6a
-		return -ENETDOWN;
443f6a
-
443f6a
 	/* Serialize all requests */
443f6a
 	hci_req_sync_lock(hdev);
443f6a
-	ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
443f6a
+	/* check the state after obtaing the lock to protect the HCI_UP
443f6a
+	 * against any races from hci_dev_do_close when the controller
443f6a
+	 * gets removed.
443f6a
+	 */
443f6a
+	if (test_bit(HCI_UP, &hdev->flags))
443f6a
+		ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
443f6a
+	else
443f6a
+		ret = -ENETDOWN;
443f6a
 	hci_req_sync_unlock(hdev);
443f6a
 
443f6a
 	return ret;
443f6a
-- 
443f6a
2.26.3
443f6a
443f6a