Description
In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: Do not perform PM inside suspend callback
syzbot reports "task hung in rpm_resume"
This is caused by aqc111_suspend calling
the PM variant of its write_cmd routine.
The simplified call trace looks like this:
rpm_suspend()
usb_suspend_both() - here udev->dev.power.runtime_status == RPM_SUSPENDING
aqc111_suspend() - called for the usb device interface
aqc111_write32_cmd()
usb_autopm_get_interface()
pm_runtime_resume_and_get()
rpm_resume() - here we call rpm_resume() on our parent
rpm_resume() - Here we wait for a status change that will never happen.
At this point we block another task which holds
rtnl_lock and locks up the whole networking stack.
Fix this by replacing the write_cmd calls with their _nopm variants
Produits et versions touchés
| Produit |
Versions touchées |
Corrigé en |
|
Linux
7.0
|
premières → < 7.0
|
7.0
|
|
Linux
6.19
|
premières → < 6.19.10
|
6.19.10
|
|
Linux
6.18
|
premières → < 6.18.20
|
6.18.20
|
|
Linux
6.12
|
premières → < 6.12.78
|
6.12.78
|
|
Linux
6.6
|
premières → < 6.6.130
|
6.6.130
|
|
Linux
6.1
|
premières → < 6.1.167
|
6.1.167
|
|
Linux
5.15
|
premières → < 5.15.203
|
5.15.203
|
|
Linux
5.10
|
premières → < 5.10.253
|
5.10.253
|
|
Linux
|
5.0
|
Pas de correctif indiqué
|
Afficher les 3 autres branches
Masquer les 3 autres branches