The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
Possible dependencies:
711f8c3fb3db ("Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM")
15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 711f8c3fb3db61897080468586b970c87c61d9e4 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Date: Mon, 31 Oct 2022 16:10:32 -0700
Subject: [PATCH] Bluetooth: L2CAP: Fix accepting connection request for
invalid SPSM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The Bluetooth spec states that the valid range for SPSM is from
0x0001-0x00ff so it is invalid to accept values outside of this range:
BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
page 1059:
Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
CVE: CVE-2022-42896
CC: stable(a)vger.kernel.org
Reported-by: Tamás Koczka <poprdi(a)google.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Reviewed-by: Tedd Ho-Jeong An <tedd.an(a)intel.com>
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 1fbe087d6ae4..3eee915fb245 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5813,6 +5813,19 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
scid, mtu, mps);
+ /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
+ * page 1059:
+ *
+ * Valid range: 0x0001-0x00ff
+ *
+ * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
+ */
+ if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
+ result = L2CAP_CR_LE_BAD_PSM;
+ chan = NULL;
+ goto response;
+ }
+
/* Check if we have socket listening on psm */
pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
&conn->hcon->dst, LE_LINK);
@@ -6001,6 +6014,18 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
psm = req->psm;
+ /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
+ * page 1059:
+ *
+ * Valid range: 0x0001-0x00ff
+ *
+ * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
+ */
+ if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
+ result = L2CAP_CR_LE_BAD_PSM;
+ goto response;
+ }
+
BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
memset(&pdu, 0, sizeof(pdu));
Hi Greg,
This 5.4.y backport series contains XFS fixes from v5.8. The patchset
has been acked by Darrick.
Brian Foster (1):
xfs: don't fail verifier on empty attr3 leaf block
Chuhong Yuan (1):
xfs: Add the missed xfs_perag_put() for xfs_ifree_cluster()
Darrick J. Wong (2):
xfs: use ordered buffers to initialize dquot buffers during quotacheck
xfs: don't fail unwritten extent conversion on writeback due to edquot
Dave Chinner (1):
xfs: gut error handling in xfs_trans_unreserve_and_mod_sb()
Eric Sandeen (1):
xfs: group quota should return EDQUOT when prj quota enabled
fs/xfs/libxfs/xfs_attr_leaf.c | 8 --
fs/xfs/libxfs/xfs_defer.c | 10 ++-
fs/xfs/xfs_dquot.c | 56 +++++++++---
fs/xfs/xfs_inode.c | 4 +-
fs/xfs/xfs_iomap.c | 2 +-
fs/xfs/xfs_trans.c | 163 +++++-----------------------------
fs/xfs/xfs_trans_dquot.c | 3 +-
7 files changed, 78 insertions(+), 168 deletions(-)
--
2.35.1
Please what time the acpi-bios error reported by the dmesg command will
be fixed, it's really annoying. I have never been able to eliminate such
reports, it's only to insert loglevel=3 in grub settings to block. But
it doesn't solve the problem, and I use google search , it's tells me
that fix this problem need a bios upgrade, but actually my hardware has
stopped upgrade, so I don't know how to do fix this, thanks
[ 0.160900] ACPI: Added _OSI(Processor Aggregator Device)
[ 0.160900] ACPI: Added _OSI(Linux-Dell-Video)
[ 0.160900] ACPI: Added _OSI(Linux-Lenovo-NV-HDMI-Audio)
[ 0.160900] ACPI: Added _OSI(Linux-HPI-Hybrid-Graphics)
[ 0.219876] ACPI BIOS Error (bug): Failure creating named object
[\_SB.PCI0.XHC.RHUB.TPLD], AE_ALREADY_EXISTS (20220331/dswload2-326)
[ 0.219885] ACPI Error: AE_ALREADY_EXISTS, During name lookup/catalog
(20220331/psobject-220)
[ 0.219889] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0014)
[ 0.219944] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS01], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.219950] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
[ 0.219953] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0010)
[ 0.219983] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS02], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.219987] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
[ 0.219990] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0010)
[ 0.220019] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS03], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.220023] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
[ 0.220026] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0010)
[ 0.220055] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS04], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.220059] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
[ 0.220062] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0010)
[ 0.220090] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS05], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.220095] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
[ 0.220098] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0010)
[ 0.220126] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS06], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.220130] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
[ 0.220133] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0010)
[ 0.220162] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS07], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.220166] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
[ 0.220169] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0010)
[ 0.220197] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS08], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.220202] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
[ 0.220205] ACPI: Skipping parse of AML opcode: OpcodeName
unavailable (0x0010)
[ 0.220233] ACPI BIOS Error (bug): Could not resolve symbol
[\_SB.PCI0.XHC.RHUB.HS09], AE_NOT_FOUND (20220331/dswload2-162)
[ 0.220237] ACPI Error: AE_NOT_FOUND, During name lookup/catalog
(20220331/psobject-220)
I urgently seek your service to represent me in investing in
your region / country and you will be rewarded for your service without
affecting your present job with very little time invested in it, which you will
be communicated in details upon response.
My dearest regards
Seyba Daniel