[LTS 8.8 RT] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm

[pvts-mat]

CVE-2022-42896
VULN-207

Solution

The bug fix in the mainline is provided¹ in two commits:

• f937b758a188d6fd328a81367087eddbb2fce50f
• 711f8c3fb3db61897080468586b970c87c61d9e4

Of these the 711f8c3 is already applied on ciqlts8_8-rt (commit 698b38781fe5e12c9a62104a6e4d2d09d1b49b68).

(Same situation as in #41)

Build

Kernel built on virtual machine instantiated on physical Rocky 9 machine with

./ninja.sh _run_build-ciqlts8_8

from the https://gitlab.conclusive.pl/devices/rocky-patching project. Installed on a testing machine created with

CVE=CVE-2022-42896 ./ninja.sh _run_test-ciqlts8_8-CVE-2022-42896

kABI check: omitted

Boot test: passed

boot-test.log

Kselftests: passed relative

Kselftests were split into two parts:

1. using kernel-rt-selftests-internal package (for ease of use and stability of the tests) and
2. using kselftests compiled from kernel source (for coverage).

Packaged tests

Tests set covered

• bpf
• livepatch
• net
• net/forwarding
• net/mptcp
• netfilter
• tc-testing
• vm

Tests stability analysis on a reference kernel

A series of 7 test runs were conducted on the reference LTS 8.8 RT kernel ciqlts8_8-rt (eca3abc5e9ff4cae5b5d2a54869f2196d281aefe) of which 3 finished without issues.

kselftests–rpm–ciqlts8_8-rt–run-1.log
kselftests–rpm–ciqlts8_8-rt–run-2.log
kselftests–rpm–ciqlts8_8-rt–run-3.log

It was found that

• Three tests are dysfunctional
  • bpf:test_progs-no_alu32, bpf:test_progs: Sometimes cause the machine to spontaneously reboot, interrupting the tests run.
  • bpf:test_xsk.sh: Sometimes hangs the machine indefinitely.
• Three tests are "flappy", their results differing depending on the run: net/mptcp:simult_flows.sh, net:gro.sh, net:udpgro_fwd.sh

For the full picture of unit tests stability state refer to the column https://docs.google.com/spreadsheets/d/1tUwJ2rV57cYZXh7momPtraSjZcHDjMYHLeHA3DYWrUU/edit?pli=1&gid=0#gid=0&range=F:F

Patched kernel

A series of 2 test runs were conducted on the patched kernel, with the machine-hanging bpf:test_xsk.sh test omitted.

kselftests–rpm–ciqlts8_8-rt-CVE-2022-42896–run-1.log
kselftests–rpm–ciqlts8_8-rt-CVE-2022-42896–run-2.log

Comparison

With the unstable tests bpf:test_progs-no_alu32, bpf:test_progs, bpf:test_xsk.sh, net/mptcp:simult_flows.sh, net:gro.sh, net:udpgro_fwd.sh omitted all test results are the same in the patched and referential kernels.

Source-compiled tests

Tests set covered

• breakpoints
• capabilities
• cgroup
• core
• cpu-hotplug
• cpufreq
• drivers/net/bonding
• drivers/net/team
• efivarfs
• exec
• filesystems
• firmware
• fpu
• ftrace
• futex
• intel_pstate
• ipc
• kcmp
• kvm
• lib
• livepatch
• membarrier
• memory-hotplug
• mount
• mqueue
• net
• net/forwarding
• net/mptcp
• netfilter
• nsfs
• proc
• pstore
• ptrace
• rtc
• sgx
• sigaltstack
• size
• splice
• static_keys
• sync
• sysctl
• tc-testing
• tdx
• timens
• timers
• tpm2
• user
• vm
• x86
• zram

Tests stability analysis on a reference kernel

A series of 2 test runs were conducted on the reference LTS 8.8 RT kernel ciqlts8_8-rt (eca3abc5e9ff4cae5b5d2a54869f2196d281aefe)

kselftests–source–ciqlts8_8-rt–run-1.log
kselftests–source–ciqlts8_8-rt–run-2.log

It was found that three tests are "flappy", their results differing depending on the run:

• ipc:msgque
• kvm:hardware_disable_test
• net:devlink_port_split.py

For the full picture of unit tests stability state refer to the column https://docs.google.com/spreadsheets/d/1tUwJ2rV57cYZXh7momPtraSjZcHDjMYHLeHA3DYWrUU/edit?pli=1&gid=0#gid=0&range=G:G

Patched kernel

A series of 2 test runs were conducted on the patched kernel

kselftests–source–ciqlts8_8-rt-CVE-2022-42896–run-1.log
kselftests–source–ciqlts8_8-rt-CVE-2022-42896–run-2.log

Comparison

With the tests found to be indeterministic in the stability analysis omitted the test results for the patched kernel were the same as for the reference kernel, except for the kvm:vmx_preemption_timer_test test.

Additional kvm test runs on the patched kernel resulted in kvm:vmx_preemption_timer_test again passing, indicating that this test is also unstable

kselftests–source–ciqlts8_8-rt-CVE-2022-42896–run-kvm.log

Additional tests: none

Following the guidelines from the precedent #41.

Footnotes

¹ GHSA-pf87-6c9q-jvm4

[PlaidCat]

[gvrose8192]

LGTM - Thanks