1.6 KiB
CVE-2024-42085
Description
In the Linux kernel, the following vulnerability has been resolved:usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlockWhen config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger systemto enter suspend status with below command:echo mem > /sys/power/stateThere will be a deadlock issue occurring. Detailed invoking path asbelow:dwc3_suspend_common() spin_lock_irqsave(&dwc->lock, flags); <-- 1st dwc3_gadget_suspend(dwc); dwc3_gadget_soft_disconnect(dwc); spin_lock_irqsave(&dwc->lock, flags); <-- 2ndThis issue is exposed by commit c7ebd8149ee5 ("usb: dwc3: gadget: FixNULL pointer dereference in dwc3_gadget_suspend") that removes the codeof checking whether dwc->gadget_driver is NULL or not. It causes thefollowing code is executed and deadlock occurs when trying to get thespinlock. In fact, the root cause is the commit 5265397f9442("usb: dwc3:Remove DWC3 locking during gadget suspend/resume") that forgot to removethe lock of otg mode. So, remove the redundant lock of otg mode duringgadget suspend/resume.
POC
Reference
No PoCs from references.