In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown<\/p>\n
The Broadcom BDC UDC driver registers its IRQ handler with
\ndevm_request_irq() in bdc_udc_init(), so the IRQ is released by devm
\nonly after bdc_remove() returns. devm releases resources in reverse
\nLIFO order, but bdc_remove() runs bdc_udc_exit() and bdc_hw_exit() ->
\nbdc_mem_free() manually before returning: bdc_udc_exit() tears down
\nindividual endpoint objects via bdc_free_ep(), while bdc_hw_exit() ->
\nbdc_mem_free() frees and NULLs the DMA-coherent status-report ring
\n(bdc->srr.sr_bds) and kfree()s bdc->bdc_ep_array. Both happen while
\nthe IRQ handler (bdc_udc_interrupt, requested with IRQF_SHARED)
\nremains deliverable in the window up to the post-remove devm
\nfree_irq().<\/p>\n
On receipt of a shared interrupt in that window, bdc_udc_interrupt()
\ndereferences bdc->srr.sr_bds[bdc->srr.dqp_index] (NULL or freed DMA)
\nand dispatches sr_handler callbacks that index into bdc_ep_array,
\ncausing a NULL-deref or use-after-free.<\/p>\n
The same window affects the delayed_work bdc->func_wake_notify, which is
\narmed from the IRQ handler via bdc_sr_uspc() -> handle_link_state_change()
\n-> schedule_delayed_work() and may self-rearm from its own callback
\nbdc_func_wake_timer(). No cancel exists anywhere in the driver, so a
\nqueued work item that fires after bdc_remove() returns and the bdc
\nstructure is devm-freed dereferences freed memory.<\/p>\n
Replace devm_request_irq() with request_irq() and add an explicit
\nfree_irq(bdc->irq, bdc) in bdc_remove(). Clear BDC_GIE before
\nfree_irq() to stop the device from asserting interrupts, then
\nfree_irq() drains any in-flight handler, then cancel_delayed_work_sync()
\ndrains the func_wake_notify delayed work. This ordering ensures the
\nIRQ handler and delayed work cannot interfere with the subsequent
\nendpoint and DMA teardown in bdc_udc_exit() and bdc_hw_exit(). Wire the
\nmatching free_irq() into the bdc_udc_init() error path so the IRQ is
\nreleased on probe failure, and route the bdc_init_ep() failure through
\nerr0 instead of returning directly.<\/p>\n
This issue was found by an in-house static analysis tool.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown<\/p>\n
The Broadcom BDC UDC driver registers its IRQ handler w<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4873","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4873"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4873"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}