In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
USB: gadget: dummy-hcd: Fix wait for outstanding request completions<\/p>\n
The dummy-hcd driver emulates synchronize_irq() by waiting until its
\nprivate callback_usage counter drops to 0 (with the private lock not
\nheld). This counter is incremented whenever a gadget driver callback
\noccurs (which requires the private lock to be dropped), but not when a
\nrequest completion handler is called.<\/p>\n
This is an oversight. Request completion is triggered by timer
\ninterrupts (emulating device IRQs in a real UDC), and the interrupt
\nhandlers are supposed to have completed when the synchronize_irq()
\nemulation routine returns — they aren’t supposed to be in the middle
\nof a completion callback. If this happens it can lead to a gadget
\ndriver’s unbind routine running before all outstanding request
\ncompletions have finished, maybe even allowing the gadget driver’s
\nmodule to be unloaded while a completion handler is still running.<\/p>\n
Fix the oversight by incrementing the callback_usage value across
\nrequest completion callbacks.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
USB: gadget: dummy-hcd: Fix wait for outstanding request completions<\/p>\n
The dummy-hcd driver emulates synchronize_irq() by waiting un<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41237","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}