[LTS 8.6 RT] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm #93
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jira VULN-205 cve CVE-2022-42896 commit-author Luiz Augusto von Dentz <[email protected]> commit f937b75 l2cap_global_chan_by_psm shall not return fixed channels as they are not meant to be connected by (S)PSM. Signed-off-by: Luiz Augusto von Dentz <[email protected]> Reviewed-by: Tedd Ho-Jeong An <[email protected]> (cherry picked from commit f937b75) Signed-off-by: Marcin Wcisło <[email protected]>
PlaidCat
requested review from
gmkurtzer,
PlaidCat,
bmastbergen and
gvrose8192
and removed request for
gmkurtzer
bmastbergen
approved these changes
Jan 28, 2025
github-actions bot
pushed a commit
that referenced
this pull request
Aug 1, 2025
damon_migrate_pages() tries migration even if the target node is invalid.
If users mistakenly make such invalid requests via
DAMOS_MIGRATE_{HOT,COLD} action, the below kernel BUG can happen.
[ 7831.883495] BUG: unable to handle page fault for address: 0000000000001f48
[ 7831.884160] #PF: supervisor read access in kernel mode
[ 7831.884681] #PF: error_code(0x0000) - not-present page
[ 7831.885203] PGD 0 P4D 0
[ 7831.885468] Oops: Oops: 0000 [#1] SMP PTI
[ 7831.885852] CPU: 31 UID: 0 PID: 94202 Comm: kdamond.0 Not tainted 6.16.0-rc5-mm-new-damon+ #93 PREEMPT(voluntary)
[ 7831.886913] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.el9 04/01/2014
[ 7831.887777] RIP: 0010:__alloc_frozen_pages_noprof (include/linux/mmzone.h:1724 include/linux/mmzone.h:1750 mm/page_alloc.c:4936 mm/page_alloc.c:5137)
[...]
[ 7831.895953] Call Trace:
[ 7831.896195] <TASK>
[ 7831.896397] __folio_alloc_noprof (mm/page_alloc.c:5183 mm/page_alloc.c:5192)
[ 7831.896787] migrate_pages_batch (mm/migrate.c:1189 mm/migrate.c:1851)
[ 7831.897228] ? __pfx_alloc_migration_target (mm/migrate.c:2137)
[ 7831.897735] migrate_pages (mm/migrate.c:2078)
[ 7831.898141] ? __pfx_alloc_migration_target (mm/migrate.c:2137)
[ 7831.898664] damon_migrate_folio_list (mm/damon/ops-common.c:321 mm/damon/ops-common.c:354)
[ 7831.899140] damon_migrate_pages (mm/damon/ops-common.c:405)
[...]
Add a target node validity check in damon_migrate_pages(). The validity
check is stolen from that of do_pages_move(), which is being used for the
move_pages() system call.
Link: https://lkml.kernel.org/r/[email protected]
Fixes: b51820e ("mm/damon/paddr: introduce DAMOS_MIGRATE_COLD action for demotion") [6.11.x]
Signed-off-by: SeongJae Park <[email protected]>
Reviewed-by: Joshua Hahn <[email protected]>
Cc: Honggyu Kim <[email protected]>
Cc: Hyeongtak Ji <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
github-actions bot
pushed a commit
that referenced
this pull request
Aug 29, 2025
commit 7e6c313 upstream. damon_migrate_pages() tries migration even if the target node is invalid. If users mistakenly make such invalid requests via DAMOS_MIGRATE_{HOT,COLD} action, the below kernel BUG can happen. [ 7831.883495] BUG: unable to handle page fault for address: 0000000000001f48 [ 7831.884160] #PF: supervisor read access in kernel mode [ 7831.884681] #PF: error_code(0x0000) - not-present page [ 7831.885203] PGD 0 P4D 0 [ 7831.885468] Oops: Oops: 0000 [#1] SMP PTI [ 7831.885852] CPU: 31 UID: 0 PID: 94202 Comm: kdamond.0 Not tainted 6.16.0-rc5-mm-new-damon+ #93 PREEMPT(voluntary) [ 7831.886913] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.el9 04/01/2014 [ 7831.887777] RIP: 0010:__alloc_frozen_pages_noprof (include/linux/mmzone.h:1724 include/linux/mmzone.h:1750 mm/page_alloc.c:4936 mm/page_alloc.c:5137) [...] [ 7831.895953] Call Trace: [ 7831.896195] <TASK> [ 7831.896397] __folio_alloc_noprof (mm/page_alloc.c:5183 mm/page_alloc.c:5192) [ 7831.896787] migrate_pages_batch (mm/migrate.c:1189 mm/migrate.c:1851) [ 7831.897228] ? __pfx_alloc_migration_target (mm/migrate.c:2137) [ 7831.897735] migrate_pages (mm/migrate.c:2078) [ 7831.898141] ? __pfx_alloc_migration_target (mm/migrate.c:2137) [ 7831.898664] damon_migrate_folio_list (mm/damon/ops-common.c:321 mm/damon/ops-common.c:354) [ 7831.899140] damon_migrate_pages (mm/damon/ops-common.c:405) [...] Add a target node validity check in damon_migrate_pages(). The validity check is stolen from that of do_pages_move(), which is being used for the move_pages() system call. Link: https://lkml.kernel.org/r/[email protected] Fixes: b51820e ("mm/damon/paddr: introduce DAMOS_MIGRATE_COLD action for demotion") [6.11.x] Signed-off-by: SeongJae Park <[email protected]> Reviewed-by: Joshua Hahn <[email protected]> Cc: Honggyu Kim <[email protected]> Cc: Hyeongtak Ji <[email protected]> Cc: <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
CVE-2022-42896
VULN-205
Solution
The bug fix in the mainline is provided1 in two commits:
f937b758a188d6fd328a81367087eddbb2fce50f711f8c3fb3db61897080468586b970c87c61d9e4Of these the
711f8c3is already applied onciqlts8_6-rt(commit0c319402e3cb34e46cad6ed4299faffa7916b670).(Same situation as in #41)
kABI check: omitted
Boot test: passed
boot-test.log
Kselftests: passed relative
Methodology
All kselftests used were compiled from the kernel source code, branch
ciqlts8_6-rt(5d362bf39d935ad7de47fa83661d2965e54ae013). Thekernel-rt-selftests-internalpackage is not available for Rocky LTS 8.6 RT.Additionally the tests were ran using the installed kselftests, as with
in order to evaluate the usefulness of this feature. (The installed selftests use the same
run_kselftest.sh-defined interface as those fromkernel-selftests-internal,kernel-rt-selftests-internalpackages, providing high granularity of tests selection and potentially streamlining testing across different rocky versions.)Covered test groups (including those skipped during execution)
android,bpf,breakpoints,capabilities,core,cpu-hotplug,cpufreq,efivarfs,exec,filesystems,firmware,fpu,ftrace,futex,gpio,intel_pstate,ipc,kcmp,kvm,lib,livepatch,membarrier,memfd,memory-hotplug,mount,net,net/forwarding,net/mptcp,netfilter,nsfs,pstore,ptrace,rseq,rtc,sgx,sigaltstack,size,splice,static_keys,sync,sysctl,tc-testing,timens,timers,tpm2,user,vm,x86,zramCompiled selftests
Tests stability analysis on a reference kernel
A series of 5 test runs were conducted on the reference LTS 8.6 RT kernel
ciqlts8_6-rt(5d362bf39d935ad7de47fa83661d2965e54ae013) of which 2 finished without issues.kselftests–source–ciqlts8_6-rt–run1.log
kselftests–source–ciqlts8_6-rt–run2.log
It was found that
bpf:test_sockmap: Sometimes hangs the machine by blocking the kworkerbpf:test_progs: Sometimes causes the machine to spontaneously reboot, interrupting the tests run. Potentially this also applies to thebpf:test_progs-no_alu32test as is the case on other Rocky versions, but on these test runs it behaved properly.ipc:msgquenet:gro.shFor the full picture of unit tests stability state refer to the column https://docs.google.com/spreadsheets/d/1tUwJ2rV57cYZXh7momPtraSjZcHDjMYHLeHA3DYWrUU/edit?pli=1&gid=0#gid=0&range=D:D
Patched kernel
A single test run was conducted on the patched kernel.
kselftests–source–ciqlts8_6-rt-CVE-2022-42896.log
Comparison
Compared to the reference kernel and omitting the unstable and flappy tests the results are identical except for the
net:reuseport_addr_any.shtest, which the reference kernel was failing while the patched kernel was passing. An additional series ofnettests were conducted on the reference kernel in hope of obtaining the passing result, without success.kselftests–source–ciqlts8_6-rt–net–run1.log
kselftests–source–ciqlts8_6-rt–net–run2.log
kselftests–source–ciqlts8_6-rt–net–run3.log
Full comparison give below
However, the passing
net:reuseport_addr_any.shtest on the reference kernel when used in the installed form (see section below) suggests that the passing result for the patched kernel is not related to the change in any way.Installed selftests
A series of 2 test runs were conducted on the reference LTS 8.6 RT kernel
ciqlts8_6-rt(5d362bf39d935ad7de47fa83661d2965e54ae013) with the tests proven to be unstable before omitted:bpf:test_progs,bpf:test_sockmap.kselftests–source-installed–ciqlts8_6-rt–run1.log
kselftests–source-installed–ciqlts8_6-rt–run2.log
It was found that the
kvm:hardware_disable_testwas flappy. Additionally, multiple tests behaved differently when run in this mode compared to the tests run withmake.The reasons were investigated cursorily and they ranged from conditional "skipping" of some tests (eg.
bpf:test_lwt_seg6local.sh) which showed as passing when invoked withmaketo what seems like an erroneous installation (rseq).The full picture is provided at https://docs.google.com/spreadsheets/d/1tUwJ2rV57cYZXh7momPtraSjZcHDjMYHLeHA3DYWrUU/edit?pli=1&gid=0#gid=0&range=E:E.
These results show that the tests ran directly from kernel source and the tests ran with
run_kselftest.shafter installation are not interchangable in a straightforward manner.Additional tests: none
Following the guidelines from the precedent #41.
Footnotes
1 GHSA-pf87-6c9q-jvm4