| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49686: usb: gadget: uvc: fix list double add in uvcg_video_pump |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| usb: gadget: uvc: fix list double add in uvcg_video_pump |
| |
| A panic can occur if the endpoint becomes disabled and the |
| uvcg_video_pump adds the request back to the req_free list after it has |
| already been queued to the endpoint. The endpoint complete will add the |
| request back to the req_free list. Invalidate the local request handle |
| once it's been queued. |
| |
| <6>[ 246.796704][T13726] configfs-gadget gadget: uvc: uvc_function_set_alt(1, 0) |
| <3>[ 246.797078][ T26] list_add double add: new=ffffff878bee5c40, prev=ffffff878bee5c40, next=ffffff878b0f0a90. |
| <6>[ 246.797213][ T26] ------------[ cut here ]------------ |
| <2>[ 246.797224][ T26] kernel BUG at lib/list_debug.c:31! |
| <6>[ 246.807073][ T26] Call trace: |
| <6>[ 246.807180][ T26] uvcg_video_pump+0x364/0x38c |
| <6>[ 246.807366][ T26] process_one_work+0x2a4/0x544 |
| <6>[ 246.807394][ T26] worker_thread+0x350/0x784 |
| <6>[ 246.807442][ T26] kthread+0x2ac/0x320 |
| |
| The Linux kernel CVE team has assigned CVE-2022-49686 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.16 with commit f9897ec0f6d34e8b2bc2f4c8ab8789351090f3d2 and fixed in 5.18.8 with commit d95ac8b920de1d39525fadc408ce675697626ca6 |
| Issue introduced in 5.16 with commit f9897ec0f6d34e8b2bc2f4c8ab8789351090f3d2 and fixed in 5.19 with commit 96163f835e65f8c9897487fac965819f0651d671 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49686 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/usb/gadget/function/uvc_video.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d95ac8b920de1d39525fadc408ce675697626ca6 |
| https://git.kernel.org/stable/c/96163f835e65f8c9897487fac965819f0651d671 |
