In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: usb-audio: Complete cleanup after system-resume errors<\/p>\n
A failed system resume can leave the card unusable until reboot.
\nusb_audio_resume() jumps to err_out when snd_usb_pcm_resume() or
\nsnd_usb_mixer_resume() fails. The error path skips the out: block, which
\nrestores D0 and decrements chip->num_suspended_intf.<\/p>\n
The card stays in SNDRV_CTL_POWER_D3hot, so later control access blocks in
\nsnd_power_ref_and_wait(). USB core logs an interface resume callback error.
\nIt does not retry that callback, so a later callback cannot complete the
\nskipped cleanup.<\/p>\n
usb_audio_suspend() increments num_suspended_intf before returning success.
\nA system-resume callback must consume the system-suspend count even if a
\ncomponent resume fails. Otherwise, the stranded count skews later suspend
\nand resume cycles.<\/p>\n
Do not apply this cleanup to runtime-resume errors. Runtime PM can retry
\n-EAGAIN or -EBUSY without another suspend callback. The count must continue
\nto describe that suspended interface. Other runtime-resume errors latch
\nruntime_error in the PM core and do not cause an immediate callback retry.<\/p>\n
Both parts of the system-resume error path are longstanding. Commit
\n88a8516a2128a (“ALSA: usbaudio: implement USB autosuspend”) introduced
\nerr_out past the D0 restore. Commit 862b2509d157c (“ALSA: usb-audio: Fix
\ninconsistent card PM state after resume”) later moved
\nnum_suspended_intf– into the out: block. The error path now skips both
\noperations.<\/p>\n
No third-party code is needed to reach the error path.
\nsnd_usb_mixer_resume() ends in snd_usb_mixer_activate(), which returns the
\nresult of usb_submit_urb() for devices that have a mixer status URB. Its
\nmixer->private_resume hook can also fail through scarlett2_init_notify().
\nsnd_usb_pcm_resume() issues a SET_CUR request to a UAC3 power domain. It
\ncan return -EPIPE or -EIO when the device stalls the request.<\/p>\n
Route a component error through out: only when system_suspend is nonzero.
\nContinue to return runtime-resume errors through err_out. Later component
\nresume stages remain skipped. The original error still reaches USB core.
\nA later transfer can fail if the device did not recover.<\/p>\n
I reproduced the system-resume failure on an Audient iD14 MkI with an
\nout-of-tree diagnostic mixer resume hook. An injected -EIO on the unpatched
\ncore left control readers in uninterruptible sleep in
\nsnd_power_ref_and_wait() until a reboot. With this patch, the same failure
\nrestored control access. A second system suspend and resume also succeeded
\nafter I disabled fault injection.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: usb-audio: Complete cleanup after system-resume errors<\/p>\n
A failed system resume can leave the card unusable until reboot.
\nusb_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17332","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}