Description
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference when host dies Make sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race and cause null pointer dereference when host suddenly dies. Usb core may call xhci_free_dev() which frees the xhci->devs[slot_id] virt device at the same time that xhci_kill_endpoint_urbs() tries to loop through all the device's endpoints, checking if there are any cancelled urbs left to give back. hold the xhci spinlock while freeing the virt device
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
11ec7588a10d4bc2e1e385ac565d2166d375fba1 to < 6fac4b5cecb3928a0a81069aaa815a2edc8dd5a1affected11ec7588a10d4bc2e1e385ac565d2166d375fba1 to < 133b902378e4acbd824c29dd0d48570ad596e368affected11ec7588a10d4bc2e1e385ac565d2166d375fba1 to < 081105213ff6f661c114781d469233c7d0e09c2eaffected11ec7588a10d4bc2e1e385ac565d2166d375fba1 to < c462ac871f49753eca86bb960f573b993976a5eaaffected11ec7588a10d4bc2e1e385ac565d2166d375fba1 to < ea2ee5e9991caf74e0604f994c1831a5867055b2affected11ec7588a10d4bc2e1e385ac565d2166d375fba1 to < a2bc47c43e70cf904b1af49f76d572326c08bca7affected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected4.19.271 to ≤ 4.19.*unaffected5.4.230 to ≤ 5.4.*unaffected5.10.165 to ≤ 5.10.*unaffected5.15.90 to ≤ 5.15.*unaffected6.1.8 to ≤ 6.1.*unaffected6.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6fac4b5cecb3928a0a81069aaa815a2edc8dd5a1 ↗
- https://git.kernel.org/stable/c/133b902378e4acbd824c29dd0d48570ad596e368 ↗
- https://git.kernel.org/stable/c/081105213ff6f661c114781d469233c7d0e09c2e ↗
- https://git.kernel.org/stable/c/c462ac871f49753eca86bb960f573b993976a5ea ↗
- https://git.kernel.org/stable/c/ea2ee5e9991caf74e0604f994c1831a5867055b2 ↗
- https://git.kernel.org/stable/c/a2bc47c43e70cf904b1af49f76d572326c08bca7 ↗