Description
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: Prevent USB core invalid event buffer address access This commit addresses an issue where the USB core could access an invalid event buffer address during runtime suspend, potentially causing SMMU faults and other memory issues in Exynos platforms. The problem arises from the following sequence. 1. In dwc3_gadget_suspend, there is a chance of a timeout when moving the USB core to the halt state after clearing the run/stop bit by software. 2. In dwc3_core_exit, the event buffer is cleared regardless of the USB core's status, which may lead to an SMMU faults and other memory issues. if the USB core tries to access the event buffer address. To prevent this hardware quirk on Exynos platforms, this commit ensures that the event buffer address is not cleared by software when the USB core is active during runtime suspend by checking its status before clearing the buffer address.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9f8a67b65a49d0e35c6ca782136c84541d948a64 to < eca3f543f817da87c00d1a5697b473efb548204faffected9f8a67b65a49d0e35c6ca782136c84541d948a64 to < d2afc2bffec77316b90d530b07695e3f534df914affected9f8a67b65a49d0e35c6ca782136c84541d948a64 to < b72da4d89b97da71e056cc4d1429b2bc426a9c2faffected9f8a67b65a49d0e35c6ca782136c84541d948a64 to < 111277b881def3153335acfe0d1f43e6cd83ac93affected9f8a67b65a49d0e35c6ca782136c84541d948a64 to < 2189fd13c577d7881f94affc09c950a795064c4baffected9f8a67b65a49d0e35c6ca782136c84541d948a64 to < 7bb11a75dd4d3612378b90e2a4aa49bdccea28abaffected9f8a67b65a49d0e35c6ca782136c84541d948a64 to < e23f6ad8d110bf632f7471482e10b43dc174fb72affected9f8a67b65a49d0e35c6ca782136c84541d948a64 to < 14e497183df28c006603cc67fd3797a537eef7b9affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected4.19.321 to ≤ 4.19.*unaffected5.4.283 to ≤ 5.4.*unaffected5.10.225 to ≤ 5.10.*unaffected5.15.166 to ≤ 5.15.*unaffected6.1.108 to ≤ 6.1.*unaffected6.6.49 to ≤ 6.6.*unaffected6.10.8 to ≤ 6.10.*unaffected6.11 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/eca3f543f817da87c00d1a5697b473efb548204f ↗
- https://git.kernel.org/stable/c/d2afc2bffec77316b90d530b07695e3f534df914 ↗
- https://git.kernel.org/stable/c/b72da4d89b97da71e056cc4d1429b2bc426a9c2f ↗
- https://git.kernel.org/stable/c/111277b881def3153335acfe0d1f43e6cd83ac93 ↗
- https://git.kernel.org/stable/c/2189fd13c577d7881f94affc09c950a795064c4b ↗
- https://git.kernel.org/stable/c/7bb11a75dd4d3612378b90e2a4aa49bdccea28ab ↗
- https://git.kernel.org/stable/c/e23f6ad8d110bf632f7471482e10b43dc174fb72 ↗
- https://git.kernel.org/stable/c/14e497183df28c006603cc67fd3797a537eef7b9 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html ↗