Description
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: gadget: fix state inconsistency on gadget init failure When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode while software state remains INACTIVE, creating hardware/software state inconsistency. When switching to host mode via sysfs: echo host > /sys/class/usb_role/13180000.usb-role-switch/role The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error, so cdns_role_stop() skips cleanup because state is still INACTIVE. This violates the DRD controller design specification (Figure22), which requires returning to idle state before switching roles. This leads to a synchronous external abort in xhci_gen_setup() when setting up the host controller: [ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19 [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed ... [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408 [ 1301.393391] backtrace: ... xhci_gen_setup+0xa4/0x408 <-- CRASH xhci_plat_setup+0x44/0x58 usb_add_hcd+0x284/0x678 ... cdns_role_set+0x9c/0xbc <-- Role switch Fix by calling cdns_drd_gadget_off() in the error path to properly clean up the DRD gadget state.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7733f6c32e36ff9d7adadf40001039bf219b1cbe to < fb7110a052467098967284ef14d306810b354937affected7733f6c32e36ff9d7adadf40001039bf219b1cbe to < 9b1d301fbae837bf6979a19030b81d869bb15f7aaffected7733f6c32e36ff9d7adadf40001039bf219b1cbe to < cfca84f5986afceb63a3adf39d4a98e915aebbc2affected7733f6c32e36ff9d7adadf40001039bf219b1cbe to < c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47faffected7733f6c32e36ff9d7adadf40001039bf219b1cbe to < 5a85599ca4d2584d89dc69f4fc49303b75a42338affected7733f6c32e36ff9d7adadf40001039bf219b1cbe to < b490f0e477d26d29ed51e5dc47e3b9bd31bcb49faffected7733f6c32e36ff9d7adadf40001039bf219b1cbe to < c32f8748d70c8fc77676ad92ed76cede17bf2c48affected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.134 to ≤ 6.6.*unaffected6.12.81 to ≤ 6.12.*unaffected6.18.22 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fb7110a052467098967284ef14d306810b354937 ↗
- https://git.kernel.org/stable/c/9b1d301fbae837bf6979a19030b81d869bb15f7a ↗
- https://git.kernel.org/stable/c/cfca84f5986afceb63a3adf39d4a98e915aebbc2 ↗
- https://git.kernel.org/stable/c/c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f ↗
- https://git.kernel.org/stable/c/5a85599ca4d2584d89dc69f4fc49303b75a42338 ↗
- https://git.kernel.org/stable/c/b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f ↗
- https://git.kernel.org/stable/c/c32f8748d70c8fc77676ad92ed76cede17bf2c48 ↗