In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback<\/p>\n
dummy_hcd embeds a single shared usb_request (dum->fifo_req) that the
\n“emulated single-request FIFO” fast-path in dummy_queue() reuses for
\nsmall IN transfers: it copies the caller’s request into it
\n(req->req = *_req) and queues it, treating list_empty(&fifo_req.queue)
\nas “the slot is free”.<\/p>\n
The completion side (dummy_timer\/transfer\/nuke\/dummy_dequeue) follows
\nthe standard pattern: list_del_init(&req->queue) unlinks the request,
\nthen the lock is dropped and usb_gadget_giveback_request() invokes
\nreq->complete(). But list_del_init() makes fifo_req.queue look empty
\n*before* the completion callback returns, so a concurrent dummy_queue()
\non another CPU sees the slot as free, reuses fifo_req and runs
\nreq->req = *_req — overwriting req->complete while dummy_timer is
\nmid-calling it. The indirect call then jumps to a clobbered pointer,
\ncausing a general protection fault \/ page fault in dummy_timer
\n(syzkaller extid faf3a6cf579fc65591ca). The clobbering write is an
\nin-bounds memcpy on a live shared object, so KASAN cannot flag it.<\/p>\n
Add a fifo_req_busy bit covering the shared request’s whole lifetime:
\nset it in dummy_queue() when the FIFO fast-path takes fifo_req (making
\nit the fast-path guard, replacing the list_empty(&fifo_req.queue)
\ntest), and clear it after the completion callback has returned, via a
\ndummy_giveback() helper used at all four gadget-request giveback
\nsites. The shared slot can no longer be reused until its completion
\ncallback has finished.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback<\/p>\n
dummy_hcd embeds a single shared usb_request (dum->fifo_req) that t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5438","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}