Description
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: unmap request DMA on queue failure mtu3_gadget_queue() maps the request before checking whether the QMU GPD ring can accept another transfer. the request is returned with -EAGAIN before it is linked on the endpoint request list if mtu3_prepare_transfer() fails. Normal completion and dequeue paths unmap requests from mtu3_req_complete(), but this error path never reaches that helper, so the DMA mapping is left active. Unmap the request before returning from the failed queue path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
df2069acb00569a6299d6e11aa1865eeba463848 to < 3cee30f1138281a1d247bb053a1ad4f7c5b04e98affecteddf2069acb00569a6299d6e11aa1865eeba463848 to < f3c4026524d3660c73ef2838b99776d37631e039affecteddf2069acb00569a6299d6e11aa1865eeba463848 to < e8f739a3860d043dcc135371637e82f53132efe5affecteddf2069acb00569a6299d6e11aa1865eeba463848 to < 4183874b7925f4a98b400cf857bea26ee87da236affecteddf2069acb00569a6299d6e11aa1865eeba463848 to < 00c3fef4c2dc2c7cbd8281f8fda09d1913420f09affecteddf2069acb00569a6299d6e11aa1865eeba463848 to < 8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1affecteddf2069acb00569a6299d6e11aa1865eeba463848 to < 835b0596d4c9bdef93f842d8f826978fb4956b74affecteddf2069acb00569a6299d6e11aa1865eeba463848 to < 0bddda5a11665c210339de76d27ebbd1a2e0b43caffected
Linux Linux
Default version status: affected
4.10affected0 to < 4.10unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3cee30f1138281a1d247bb053a1ad4f7c5b04e98 ↗
- https://git.kernel.org/stable/c/f3c4026524d3660c73ef2838b99776d37631e039 ↗
- https://git.kernel.org/stable/c/e8f739a3860d043dcc135371637e82f53132efe5 ↗
- https://git.kernel.org/stable/c/4183874b7925f4a98b400cf857bea26ee87da236 ↗
- https://git.kernel.org/stable/c/00c3fef4c2dc2c7cbd8281f8fda09d1913420f09 ↗
- https://git.kernel.org/stable/c/8c29d9cfab1c3cf0d0b7fcdf9255597be30aa3e1 ↗
- https://git.kernel.org/stable/c/835b0596d4c9bdef93f842d8f826978fb4956b74 ↗
- https://git.kernel.org/stable/c/0bddda5a11665c210339de76d27ebbd1a2e0b43c ↗