In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: gadget: Replace listforeachentrysafe() if using giveback
The listforeachentrysafe() macro saves the current item (n) and the item after (n+1), so that n can be safely removed without corrupting the list. However, when traversing the list and removing items using gadget giveback, the DWC3 lock is briefly released, allowing other routines to execute. There is a situation where, while items are being removed from the cancelledlist using dwc3gadgetepcleanupcancelledrequests(), the pullup disable routine is running in parallel (due to UDC unbind). As the cleanup routine removes n, and the pullup disable removes n+1, once the cleanup retakes the DWC3 lock, it references a request who was already removed/handled. With list debug enabled, this leads to a panic. Ensure all instances of the macro are replaced where gadget giveback is used.
Example call stack:
Thread#1: _dwc3gadgetepsethalt() - CLEAR HALT -> dwc3gadgetepcleanupcancelledrequests() ->listforeachentrysafe() ->dwc3gadgetgiveback(n) ->dwc3gadgetdelandunmaprequest()- n deleted[cancelledlist] ->spinunlock ->Thread#2 executes ... ->dwc3gadget_giveback(n+1) ->Already removed!
Thread#2: dwc3gadgetpullup() ->waiting for dwc3 spinlock ... ->Thread#1 released lock ->dwc3stopactivetransfers() ->dwc3removerequests() ->fetches n+1 item from cancelledlist (n removed by Thread#1) ->dwc3gadgetgiveback() ->dwc3gadgetdelandunmaprequest()- n+1 deleted[cancelledlist] ->spinunlock
[
{
"id": "CVE-2022-49398-008dbd4b",
"target": {
"function": "dwc3_gadget_ep_cleanup_cancelled_requests",
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a",
"signature_type": "Function",
"digest": {
"function_hash": "265136469249575710805960768677634536138",
"length": 636.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-339fd80b",
"target": {
"function": "dwc3_gadget_ep_cleanup_completed_requests",
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf594d1d0c1d7b895954018043536ffd327844f9",
"signature_type": "Function",
"digest": {
"function_hash": "290427525708724808554545106266207674205",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-40205798",
"target": {
"function": "dwc3_gadget_ep_cleanup_cancelled_requests",
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf594d1d0c1d7b895954018043536ffd327844f9",
"signature_type": "Function",
"digest": {
"function_hash": "265136469249575710805960768677634536138",
"length": 636.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-587ceb7d",
"target": {
"function": "dwc3_gadget_ep_cleanup_completed_requests",
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26a7e6832afe9d9a991cfd9015177f083cf959cc",
"signature_type": "Function",
"digest": {
"function_hash": "290427525708724808554545106266207674205",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-a496e88b",
"target": {
"function": "dwc3_gadget_ep_cleanup_cancelled_requests",
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26a7e6832afe9d9a991cfd9015177f083cf959cc",
"signature_type": "Function",
"digest": {
"function_hash": "265136469249575710805960768677634536138",
"length": 636.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-ad191edc",
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf594d1d0c1d7b895954018043536ffd327844f9",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227753405993709220182623427084943873450",
"315589225355651394863968229562620058406",
"282470718421313811311324164779853085464",
"84613368233235838978718875129199477645",
"310585520685969656334813015300145795196",
"51163572163754397856487878896669711500",
"256679839398943152926894715454113913293",
"297617461409458185190709344188939746470",
"75407180318704451699303769443305508093",
"71049959991640800739753702641286769788",
"198643669228836029931472515188494715857",
"81247685527232600869421482721690736474",
"183452079469850167838725113710917897675",
"254057302458696701048064903547221761220",
"241797921441213534293307291413596786807",
"225051814715861979319459978180914379230",
"197684022834450037208832218643111408630",
"170482347661211636253078732052682398642",
"99639078464081935309689594524023028700",
"51639105300773131409887015873457919777"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-b3ac71df",
"target": {
"function": "dwc3_gadget_ep_cleanup_cancelled_requests",
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2424307cdf421ac72075a1384eae4e4199ab6457",
"signature_type": "Function",
"digest": {
"function_hash": "265136469249575710805960768677634536138",
"length": 636.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-d06b4fc0",
"target": {
"function": "dwc3_gadget_ep_cleanup_completed_requests",
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2424307cdf421ac72075a1384eae4e4199ab6457",
"signature_type": "Function",
"digest": {
"function_hash": "290427525708724808554545106266207674205",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-ec427308",
"target": {
"function": "dwc3_gadget_ep_cleanup_completed_requests",
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a",
"signature_type": "Function",
"digest": {
"function_hash": "290427525708724808554545106266207674205",
"length": 263.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-f63dc558",
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26a7e6832afe9d9a991cfd9015177f083cf959cc",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227753405993709220182623427084943873450",
"315589225355651394863968229562620058406",
"282470718421313811311324164779853085464",
"84613368233235838978718875129199477645",
"310585520685969656334813015300145795196",
"51163572163754397856487878896669711500",
"256679839398943152926894715454113913293",
"297617461409458185190709344188939746470",
"75407180318704451699303769443305508093",
"71049959991640800739753702641286769788",
"198643669228836029931472515188494715857",
"81247685527232600869421482721690736474",
"183452079469850167838725113710917897675",
"254057302458696701048064903547221761220",
"241797921441213534293307291413596786807",
"225051814715861979319459978180914379230",
"197684022834450037208832218643111408630",
"170482347661211636253078732052682398642",
"99639078464081935309689594524023028700",
"51639105300773131409887015873457919777"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-f8252ba8",
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2424307cdf421ac72075a1384eae4e4199ab6457",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227753405993709220182623427084943873450",
"315589225355651394863968229562620058406",
"282470718421313811311324164779853085464",
"84613368233235838978718875129199477645",
"310585520685969656334813015300145795196",
"51163572163754397856487878896669711500",
"256679839398943152926894715454113913293",
"297617461409458185190709344188939746470",
"75407180318704451699303769443305508093",
"71049959991640800739753702641286769788",
"198643669228836029931472515188494715857",
"81247685527232600869421482721690736474",
"183452079469850167838725113710917897675",
"254057302458696701048064903547221761220",
"241797921441213534293307291413596786807",
"225051814715861979319459978180914379230",
"197684022834450037208832218643111408630",
"170482347661211636253078732052682398642",
"99639078464081935309689594524023028700",
"51639105300773131409887015873457919777"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49398-faa3bb1b",
"target": {
"file": "drivers/usb/dwc3/gadget.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1c6e5dc3b639c96e6839a8d1b8e951923fdfd34a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227753405993709220182623427084943873450",
"315589225355651394863968229562620058406",
"282470718421313811311324164779853085464",
"84613368233235838978718875129199477645",
"310585520685969656334813015300145795196",
"51163572163754397856487878896669711500",
"256679839398943152926894715454113913293",
"297617461409458185190709344188939746470",
"75407180318704451699303769443305508093",
"71049959991640800739753702641286769788",
"198643669228836029931472515188494715857",
"81247685527232600869421482721690736474",
"183452079469850167838725113710917897675",
"254057302458696701048064903547221761220",
"241797921441213534293307291413596786807",
"225051814715861979319459978180914379230",
"197684022834450037208832218643111408630",
"170482347661211636253078732052682398642",
"99639078464081935309689594524023028700",
"51639105300773131409887015873457919777"
]
},
"deprecated": false,
"signature_version": "v1"
}
]