diff options
Diffstat (limited to 'recipes-kernel')
111 files changed, 31311 insertions, 0 deletions
diff --git a/recipes-kernel/linux/crypto.inc b/recipes-kernel/linux/crypto.inc new file mode 100644 index 0000000..a557ded --- /dev/null +++ b/recipes-kernel/linux/crypto.inc @@ -0,0 +1,17 @@ +# modules to load for Crypto on boot +KERNEL_MODULE_AUTOLOAD_mtcdt += " \ + sha512_generic \ +" + +KERNEL_MODULE_AUTOLOAD_mtrv1 += " \ + sha512_generic \ +" + + +KERNEL_MODULE_AUTOLOAD_mtr += " \ + sha512_generic \ +" + +KERNEL_MODULE_AUTOLOAD_mtcap += " \ + sha512_generic \ +" diff --git a/recipes-kernel/linux/driver.inc b/recipes-kernel/linux/driver.inc new file mode 100644 index 0000000..5e21ed6 --- /dev/null +++ b/recipes-kernel/linux/driver.inc @@ -0,0 +1,22 @@ +# Hardware drivers to load on boot. +# Gadget serial is for MTCDT only + +DRIVER_LOAD_ALL_MACHINES = " \ + atmel_usba_udc \ + ledtrig-default-on \ + ledtrig-heartbeat \ + ledtrig-timer \ +" + +KERNEL_MODULE_AUTOLOAD_mtcdt += " \ + ${DRIVER_LOAD_ALL_MACHINES} \ + g_serial \ +" + + +# Is atmel_usba_udc needed for mtcap? +KERNEL_MODULE_AUTOLOAD_mtcap += "${DRIVER_LOAD_ALL_MACHINES}" + +KERNEL_MODULE_AUTOLOAD_mtrv1 += "${DRIVER_LOAD_ALL_MACHINES}" + +KERNEL_MODULE_AUTOLOAD_mtr += "${DRIVER_LOAD_ALL_MACHINES}" diff --git a/recipes-kernel/linux/linux-3.12.70/bluetooth_l2cap.patch b/recipes-kernel/linux/linux-3.12.70/bluetooth_l2cap.patch new file mode 100644 index 0000000..c6bfdf7 --- /dev/null +++ b/recipes-kernel/linux/linux-3.12.70/bluetooth_l2cap.patch @@ -0,0 +1,357 @@ +From e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 Mon Sep 17 00:00:00 2001 +From: Ben Seri <ben@armis.com> +Date: Sat, 9 Sep 2017 23:15:59 +0200 +Subject: Bluetooth: Properly check L2CAP config option output buffer length + +Validate the output buffer length for L2CAP config requests and responses +to avoid overflowing the stack buffer used for building the option blocks. + +Cc: stable@vger.kernel.org +Signed-off-by: Ben Seri <ben@armis.com> +Signed-off-by: Marcel Holtmann <marcel@holtmann.org> +Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> +--- + net/bluetooth/l2cap_core.c | 80 +++++++++++++++++++++++++--------------------- + 1 file changed, 43 insertions(+), 37 deletions(-) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 303c779..43ba91c 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -58,7 +58,7 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, + u8 code, u8 ident, u16 dlen, void *data); + static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, + void *data); +-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data); ++static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); + static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); + + static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, +@@ -1473,7 +1473,7 @@ static void l2cap_conn_start(struct l2cap_conn *conn) + + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -2987,12 +2987,15 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, + return len; + } + +-static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) ++static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) + { + struct l2cap_conf_opt *opt = *ptr; + + BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); + ++ if (size < L2CAP_CONF_OPT_SIZE + len) ++ return; ++ + opt->type = type; + opt->len = len; + +@@ -3017,7 +3020,7 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) + *ptr += L2CAP_CONF_OPT_SIZE + len; + } + +-static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan) ++static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) + { + struct l2cap_conf_efs efs; + +@@ -3045,7 +3048,7 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan) + } + + l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, size); + } + + static void l2cap_ack_timeout(struct work_struct *work) +@@ -3191,11 +3194,12 @@ static inline void l2cap_txwin_setup(struct l2cap_chan *chan) + chan->ack_win = chan->tx_win; + } + +-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) ++static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) + { + struct l2cap_conf_req *req = data; + struct l2cap_conf_rfc rfc = { .mode = chan->mode }; + void *ptr = req->data; ++ void *endptr = data + data_size; + u16 size; + + BT_DBG("chan %p", chan); +@@ -3220,7 +3224,7 @@ static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) + + done: + if (chan->imtu != L2CAP_DEFAULT_MTU) +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); + + switch (chan->mode) { + case L2CAP_MODE_BASIC: +@@ -3239,7 +3243,7 @@ done: + rfc.max_pdu_size = 0; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + break; + + case L2CAP_MODE_ERTM: +@@ -3259,21 +3263,21 @@ done: + L2CAP_DEFAULT_TX_WINDOW); + + l2cap_add_conf_opt(&ptr, L2CA |