lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sun, 13 May 2012 07:31:21 +0300
From:	Johan Hedberg <johan.hedberg@...il.com>
To:	Gustavo Padovan <gustavo@...ovan.org>,
	"John W. Linville" <linville@...driver.com>,
	David Miller <davem@...emloft.net>,
	linux-wireless@...r.kernel.org, linux-bluetooth@...r.kernel.org,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: pull request: bluetooth 2012-05-04

Hi,

On Sat, May 12, 2012, Gustavo Padovan wrote:
> In my point of view there are two commits there that are really necessary:
> 
> Gustavo Padovan (2):
>       Bluetooth: report the right security level in getsockopt
> 
> Johan Hedberg (2):
>       Bluetooth: mgmt: Fix device_connected sending order
> 
> They fix a userspace breakage caused by:
> 
> Author: Marcel Holtmann <marcel@...tmann.org>
> Date:   Mon Feb 20 21:24:37 2012 +0100
> 
>     Bluetooth: Always enable management interface
>     
>     The management interface API has reached stable version 1.0 and thus
>     it can now be always enabled. All future changes will be made backwards
>     compatible.
>     
>     Signed-off-by: Marcel Holtmann <marcel@...tmann.org>
>     Signed-off-by: Johan Hedberg <johan.hedberg@...el.com>
> 
> 
> This cause no crash, but it make bluetooth keyboards stop to work with Linux.
> This a serious breakage IMO. I really would like to see at least these two
> patches in. The other fixes can wait.

I'd just like to add some further background since I don't think it's
that obvious how these are regression fixes:

The device_connected fix should be quite self-explanatory, but it's
actually a wider issue than just for keyboards. All profiles that do
incoming connection authorization (e.g. headsets) will break without it
with specific hardware. The reason it wasn't caught earlier is that it
only occurs with specific Bluetooth adapters.

As for the security level patch, this fixes L2CAP socket based security
level elevation during a connection. The HID profile needs this (for
keyboards) and it is the only way to achieve the security level
elevation when using the management interface to talk to the kernel
(hence the management enabling patch being the one that exposes this
issue).

Johan
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Powered by blists - more mailing lists