Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 11 Oct 2021 09:13:24 +0200
Message-ID: <s5h7dek590r.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     Salvatore Bonaccorso <carnil@debian.org>
Cc:     Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        LinMa <linma@zju.edu.cn>,
        "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>,
        Marcel Holtmann <marcel@holtmann.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        Linus Torvalds <torvalds@linux-foundation.org>, tiwai@suse.com
Subject: Re: [PATCH] Bluetooth: avoid page fault from sco_send_frame()
In-Reply-To: <YWPg8Ck2ZbXZxOtD@eldamar.lan>
References: <15f5a46.b79d9.17ba6802ccd.Coremail.linma@zju.edu.cn>
        <c998d16d-f45a-8be4-2898-9e94509cb2ea@i-love.sakura.ne.jp>
        <60f604f8-2a89-fd3f-996f-9d9e4a229427@i-love.sakura.ne.jp>
        <CABBYNZK-JvPcB_T39_NUE-O6ztE6crNEfmFxszEtAu3OkrKF2A@mail.gmail.com>
        <a7bed103-dbb1-6783-aba7-f18a4d495c13@i-love.sakura.ne.jp>
        <883dc4b7-d1a1-3d31-a5a8-8fa1791084b6@i-love.sakura.ne.jp>
        <YWPg8Ck2ZbXZxOtD@eldamar.lan>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka)
 FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3
 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk

On Mon, 11 Oct 2021 09:00:00 +0200,
Salvatore Bonaccorso wrote:
> 
> Hi,
> 
> On Sat, Sep 04, 2021 at 11:02:58AM +0900, Tetsuo Handa wrote:
> > Commit 99c23da0eed4fd20 ("Bluetooth: sco: Fix lock_sock() blockage
> > by memcpy_from_msg()") in linux-next.git should be sent to linux.git
> > now as a mitigation for CVE-2021-3640.
> > 
> > But I think "[PATCH v3 3/4] Bluetooth: SCO: Replace use of
> > memcpy_from_msg with bt_skb_sendmsg" still contains bug.
> 
> Did his one felt through the cracks? I'm confused about the statement
> in https://bugzilla.suse.com/show_bug.cgi?id=1188172#c8 so Cc'ing
> Takashi Iwai as well.

The quite similar fix has been already in the subsystem tree,
commit 99c23da0eed4 ("Bluetooth: sco: Fix lock_sock() blockage by
memcpy_from_msg()").  The particular CVE should be covered by that and
prerequisite patches.


Takashi