Description
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it. e.g. qmu done irq on cpu0 thread running on cpu1 qmu_done_tx() handle gpd [0] mtu3_requ_complete() mtu3_gadget_ep_disable() unlock @mtu->lock give back request lock @mtu->lock mtu3_ep_disable() mtu3_gpd_ring_free() unlock @mtu->lock lock @mtu->lock get next gpd [1] [1]: goto [0] to handle next gpd, and next gpd may be NULL.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
48e0d3735aa557a8adaf94632ca3cf78798e8505 to < 26ca30516b2c49dd04c134cbdf122311c538df98affected48e0d3735aa557a8adaf94632ca3cf78798e8505 to < 012936502a9cb7b0604e85bb961eb15e2bb40dd9affected48e0d3735aa557a8adaf94632ca3cf78798e8505 to < ee53a7a88027cea765c68f3b00a50b8f58d6f786affected48e0d3735aa557a8adaf94632ca3cf78798e8505 to < f26273428657ef4ca74740e578ae45a3be492f6faffected48e0d3735aa557a8adaf94632ca3cf78798e8505 to < b636aff94a67be46582d4321d11743f1a10cc2c1affected48e0d3735aa557a8adaf94632ca3cf78798e8505 to < 3a7d4959560a2ee493ef222e3b63d359365f41ecaffected48e0d3735aa557a8adaf94632ca3cf78798e8505 to < d28f4091ea7ec3510fd6a3c6d433234e7a2bef14affected
Linux Linux
Default version status: affected
5.2affected0 to < 5.2unaffected5.4.243 to ≤ 5.4.*unaffected5.10.180 to ≤ 5.10.*unaffected5.15.111 to ≤ 5.15.*unaffected6.1.28 to ≤ 6.1.*unaffected6.2.15 to ≤ 6.2.*unaffected6.3.2 to ≤ 6.3.*unaffected6.4 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/26ca30516b2c49dd04c134cbdf122311c538df98 ↗
- https://git.kernel.org/stable/c/012936502a9cb7b0604e85bb961eb15e2bb40dd9 ↗
- https://git.kernel.org/stable/c/ee53a7a88027cea765c68f3b00a50b8f58d6f786 ↗
- https://git.kernel.org/stable/c/f26273428657ef4ca74740e578ae45a3be492f6f ↗
- https://git.kernel.org/stable/c/b636aff94a67be46582d4321d11743f1a10cc2c1 ↗
- https://git.kernel.org/stable/c/3a7d4959560a2ee493ef222e3b63d359365f41ec ↗
- https://git.kernel.org/stable/c/d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 ↗