Hacker News Reader

Comment by morsch | Hacker News Reader

Fixed in https://android.googlesource.com/platform/system/bt/+/3cb714... of https://source.android.com/security/bulletin/2020-02-01:

  -        packet->len = partial_packet->len - partial_packet->offset;
  +        packet->len =
  +            (partial_packet->len - partial_packet->offset) + packet->offset;

I wonder how many devices are running that patch level.

View on HN

My Google Pixel 1 isn’t running this patch level, because Google dropped support for it entirely. Which just sucks, because there’s no reason not to support it anymore, it’s just planned obsolescence.

The Pixel 1's kernel and drivers are no longer maintained upstream.

Do you mean there's a Linux tree upstream of Google but downstream from Linus who have stopped work outside of Google control?

Yes, sort of. Google depends on Qualcomm to make updated drivers, as Qualcomm owns the intellectual property. All Pixel phones are based on a Qualcomm platform.

Qualcomm stops supporting their processors after a few years, usually three. They can make more money by selling new chips. Although I say this cynically, Qualcomm is actually the best third party vendor in this regard.

They must have the source code for any chipset vendor kernel drivers due to the GPL so they could keep producing security patches, or require them contractually. Some other Linux vendors keep supporting old ketnel versions for 10+ years after all.

Linux kernel drivers don't have to be GPL though. There exist plenty of closed source drivers for GNU/Linux. The "kernel" on Android devices are a small open source kernel and a huge amount of closed source blobs for wireless connectivity, sensors and the GPU.

That legal interpretation has been contested a lot. In any case that wouldn't be a blocker for providing security patches to the kernel, just like other LTS Linux distributions do.

There is this little legal thing called support contracts that Google could easily make use of for their devices, if they actually cared.

Since Google supports Pixel devices longer than the three years Qualcomm gives or used to give, they're probably already doing that. Not saying they care enough, but they care more than any vendor besides Apple.

Do they? I thought they do max(3 years from launch, 18 months after sales ends in Google store), which usually amounts to 3 years.

Edit: J"ust like their predecessors, they'll get Android security updates for three years, until October 2022." says Android Police.

Considering most people don't buy it at launch, this amounts to 2-ish years of support on average.

It's all dependant on Linus' version being maintained.

which is irrelevant for this userspace-only fix

are you saying google cannot afford to maintain it/them?

Basically they could maintain the Android environment but it wouldn't mean much because the system's still not safe, and won't be unless the device gets a new kernel + rebuilt drivers.

Which they could easily do with support contract requirements.

I assume Google can afford a couple of lawyers.

I happily run two Pixel 1's on LineageOS, which recently released Android 10 for these devices. Thats the mainthing select phones by: how is their LineageOS support?

Yeah, There is guaranteed window of many phones/manufactures that the patch will be 6 months or never far away.

Strange that the commit is from 2018 but it was only included in the patch level of February 5?

At least Samsung is pretty good about updating patches. Not android versions, no, but at least I still get monthly patches. My S8 already has this one.

It's not from 2018 -- Thu Apr 18 17:13:49 2019 -- the 18 may have tripped you up, it's the day of month. It's still a year old, though.

It's a cherry-pick (a copy of a commit from related code base, essentially) of this commit, https://android.googlesource.com/platform/system/bt/+/337bd4.... The bug has a different impact in Android 10 (DOS instead of RCE), which was relased in Septemer 2019. So maybe they sort of fixed it in Android 10 and somehow forgot the backport? I'm speculating.

Depends which Samsung you have, my last Samsung update was on the 4th of January. Support for their non-flagship devices isn't great.

Reply on news.ycombinator.com