Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]USB: gadget: Fix use-after-free Read in usb_udc_uevent()[EOL][EOL]The syzbot fuzzer found a race between uevent callbacks and gadget[EOL]driver unregistration that can cause a use-after-free bug:[EOL][EOL]---------------------------------------------------------------[EOL]BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130[EOL]drivers/usb/gadget/udc/core.c:1732[EOL]Read of size 8 at addr ffff888078ce2050 by task udevd/2968[EOL][EOL]CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0[EOL]Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google[EOL]06/29/2022[EOL]Call Trace:[EOL] <TASK>[EOL] __dump_stack lib/dump_stack.c:88 [inline][EOL] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106[EOL] print_address_description mm/kasan/report.c:317 [inline][EOL] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433[EOL] kasan_report+0xbe/0x1f0 mm/kasan/report.c:495[EOL] usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732[EOL] dev_uevent+0x290/0x770 drivers/base/core.c:2424[EOL]---------------------------------------------------------------[EOL][EOL]The bug occurs because usb_udc_uevent() dereferences udc->driver but[EOL]does so without acquiring the udc_lock mutex, which protects this[EOL]field.  If the gadget driver is unbound from the udc concurrently with[EOL]uevent processing, the driver structure may be accessed after it has[EOL]been deallocated.[EOL][EOL]To prevent the race, we make sure that the routine holds the mutex[EOL]around the racing accesses.

CREATE(Triage):(User=lchen-cn) [CVE-2022-49980 (https://nvd.nist.gov/vuln/detail/CVE-2022-49980)