In the Linux kernel, the following vulnerability has been resolved:
USB: core: Prevent nested device-reset calls
Automatic kernel fuzzing revealed a recursive locking violation in usb-storage:
============================================ WARNING: possible recursive locking detected
kworker/1:3/1205 is trying to acquire lock: ffff888018638db8 (&usinterfacekey[i]){+.+.}-{3:3}, at: usbstorpre_reset+0x35/0x40 drivers/usb/storage/usb.c:230
but task is already holding lock: ffff888018638db8 (&usinterfacekey[i]){+.+.}-{3:3}, at: usbstorpre_reset+0x35/0x40 drivers/usb/storage/usb.c:230
...
stack backtrace: CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usbhubwq hubevent Call Trace: <TASK> _dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xcd/0x134 lib/dumpstack.c:106 printdeadlockbug kernel/locking/lockdep.c:2988 [inline] checkdeadlock kernel/locking/lockdep.c:3031 [inline] validatechain kernel/locking/lockdep.c:3816 [inline] _lockacquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053 lockacquire kernel/locking/lockdep.c:5665 [inline] lockacquire+0x1ab/0x520 kernel/locking/lockdep.c:5630 _mutexlockcommon kernel/locking/mutex.c:603 [inline] _mutexlock+0x14f/0x1610 kernel/locking/mutex.c:747 usbstorprereset+0x35/0x40 drivers/usb/storage/usb.c:230 usbresetdevice+0x37d/0x9a0 drivers/usb/core/hub.c:6109 r871xudevremove+0x21a/0x270 drivers/staging/rtl8712/usbintf.c:622 usbunbindinterface+0x1bd/0x890 drivers/usb/core/driver.c:458 deviceremove drivers/base/dd.c:545 [inline] deviceremove+0x11f/0x170 drivers/base/dd.c:537 _devicereleasedriver drivers/base/dd.c:1222 [inline] devicereleasedriverinternal+0x1a7/0x2f0 drivers/base/dd.c:1248 usbdriverreleaseinterface+0x102/0x180 drivers/usb/core/driver.c:627 usbforcedunbindintf+0x4d/0xa0 drivers/usb/core/driver.c:1118 usbresetdevice+0x39b/0x9a0 drivers/usb/core/hub.c:6114
This turned out not to be an error in usb-storage but rather a nested device reset attempt. That is, as the rtl8712 driver was being unbound from a composite device in preparation for an unrelated USB reset (that driver does not have prereset or postreset callbacks), its ->remove routine called usbresetdevice() -- thus nesting one reset call within another.
Performing a reset as part of disconnect processing is a questionable practice at best. However, the bug report points out that the USB core does not have any protection against nested resets. Adding a resetinprogress flag and testing it will prevent such errors in the future.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc9a12e12808af178c600cc485338bac2e37d2a8",
"target": {
"file": "include/linux/usb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-0d6ee485",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204610629997783010967989675556561419103",
"94283947947277431274517199611651528484",
"94973003914778820113028020336195934210",
"226998726783095117784045082188969520294",
"159631660585107629610089994411658343132",
"228988826527191883158516609323320397883",
"317389211880996271111462546485860956009"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df1875084898b15cbc42f712e93d7f113ae6271b",
"target": {
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-1d96ca3b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327145145816495778087710301792415105252",
"208798929782609769909459961314477298151",
"140208479920302929963579720591320218833",
"45563350771862114016186356789724294964",
"64383634714217912072974582373702303374",
"157104929172866175571085364714921905408",
"295806913365911212960595848854404566835",
"292976246214099225630051359820535089165",
"196361983391073498431556617609875481857",
"197921658545726985091245098713590906540"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c6d778800b921bde3bff3cff5003d1650f942d1",
"target": {
"function": "usb_reset_device",
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-2dedf695",
"signature_type": "Function",
"digest": {
"length": 1506.0,
"function_hash": "87841502777393794726586215000985423473"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c548b99e1c37db6f7df86ecfe9a1f895d6c5966e",
"target": {
"function": "usb_reset_device",
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-2ebaae13",
"signature_type": "Function",
"digest": {
"length": 1506.0,
"function_hash": "87841502777393794726586215000985423473"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b29498669914c7f9afb619722421418a753d372",
"target": {
"file": "include/linux/usb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-327c07ca",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204610629997783010967989675556561419103",
"94283947947277431274517199611651528484",
"94973003914778820113028020336195934210",
"226998726783095117784045082188969520294",
"159631660585107629610089994411658343132",
"228988826527191883158516609323320397883",
"317389211880996271111462546485860956009"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b29498669914c7f9afb619722421418a753d372",
"target": {
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-32dd89e9",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327145145816495778087710301792415105252",
"208798929782609769909459961314477298151",
"140208479920302929963579720591320218833",
"45563350771862114016186356789724294964",
"64383634714217912072974582373702303374",
"157104929172866175571085364714921905408",
"295806913365911212960595848854404566835",
"292976246214099225630051359820535089165",
"196361983391073498431556617609875481857",
"197921658545726985091245098713590906540"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c6d778800b921bde3bff3cff5003d1650f942d1",
"target": {
"file": "include/linux/usb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-3e25e2e7",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204610629997783010967989675556561419103",
"94283947947277431274517199611651528484",
"94973003914778820113028020336195934210",
"157175221011317244487150556839020192222",
"116621667911420374145300983047251462549",
"228988826527191883158516609323320397883",
"317389211880996271111462546485860956009"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe3cfb7a7c8e907b312c7dbd7bf4d142b745aa8",
"target": {
"file": "include/linux/usb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-46304131",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204610629997783010967989675556561419103",
"94283947947277431274517199611651528484",
"94973003914778820113028020336195934210",
"157175221011317244487150556839020192222",
"116621667911420374145300983047251462549",
"228988826527191883158516609323320397883",
"317389211880996271111462546485860956009"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c6d778800b921bde3bff3cff5003d1650f942d1",
"target": {
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-69a7c645",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327145145816495778087710301792415105252",
"208798929782609769909459961314477298151",
"140208479920302929963579720591320218833",
"45563350771862114016186356789724294964",
"64383634714217912072974582373702303374",
"157104929172866175571085364714921905408",
"295806913365911212960595848854404566835",
"292976246214099225630051359820535089165",
"196361983391073498431556617609875481857",
"197921658545726985091245098713590906540"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c548b99e1c37db6f7df86ecfe9a1f895d6c5966e",
"target": {
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-6d0b8f4c",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327145145816495778087710301792415105252",
"208798929782609769909459961314477298151",
"140208479920302929963579720591320218833",
"45563350771862114016186356789724294964",
"64383634714217912072974582373702303374",
"157104929172866175571085364714921905408",
"295806913365911212960595848854404566835",
"292976246214099225630051359820535089165",
"196361983391073498431556617609875481857",
"197921658545726985091245098713590906540"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df1875084898b15cbc42f712e93d7f113ae6271b",
"target": {
"file": "include/linux/usb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-7623fd5f",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204610629997783010967989675556561419103",
"94283947947277431274517199611651528484",
"94973003914778820113028020336195934210",
"157175221011317244487150556839020192222",
"116621667911420374145300983047251462549",
"228988826527191883158516609323320397883",
"317389211880996271111462546485860956009"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc9a12e12808af178c600cc485338bac2e37d2a8",
"target": {
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-863a6c3b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327145145816495778087710301792415105252",
"208798929782609769909459961314477298151",
"140208479920302929963579720591320218833",
"45563350771862114016186356789724294964",
"64383634714217912072974582373702303374",
"157104929172866175571085364714921905408",
"295806913365911212960595848854404566835",
"292976246214099225630051359820535089165",
"196361983391073498431556617609875481857",
"197921658545726985091245098713590906540"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d90419b8b8322b6924f6da9da952647f2dadc21b",
"target": {
"function": "usb_reset_device",
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-8a1774a8",
"signature_type": "Function",
"digest": {
"length": 1506.0,
"function_hash": "87841502777393794726586215000985423473"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c548b99e1c37db6f7df86ecfe9a1f895d6c5966e",
"target": {
"file": "include/linux/usb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-94ed7a07",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204610629997783010967989675556561419103",
"94283947947277431274517199611651528484",
"94973003914778820113028020336195934210",
"157175221011317244487150556839020192222",
"116621667911420374145300983047251462549",
"228988826527191883158516609323320397883",
"317389211880996271111462546485860956009"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe3cfb7a7c8e907b312c7dbd7bf4d142b745aa8",
"target": {
"function": "usb_reset_device",
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-97f3cf9b",
"signature_type": "Function",
"digest": {
"length": 1506.0,
"function_hash": "87841502777393794726586215000985423473"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5eb850b3e8836197a38475840725260b9783e94",
"target": {
"file": "include/linux/usb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-a6706b18",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204610629997783010967989675556561419103",
"94283947947277431274517199611651528484",
"94973003914778820113028020336195934210",
"157175221011317244487150556839020192222",
"116621667911420374145300983047251462549",
"228988826527191883158516609323320397883",
"317389211880996271111462546485860956009"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d90419b8b8322b6924f6da9da952647f2dadc21b",
"target": {
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-a9ac2dd2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327145145816495778087710301792415105252",
"208798929782609769909459961314477298151",
"140208479920302929963579720591320218833",
"45563350771862114016186356789724294964",
"64383634714217912072974582373702303374",
"157104929172866175571085364714921905408",
"295806913365911212960595848854404566835",
"292976246214099225630051359820535089165",
"196361983391073498431556617609875481857",
"197921658545726985091245098713590906540"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5eb850b3e8836197a38475840725260b9783e94",
"target": {
"function": "usb_reset_device",
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-aaa95118",
"signature_type": "Function",
"digest": {
"length": 1506.0,
"function_hash": "87841502777393794726586215000985423473"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d90419b8b8322b6924f6da9da952647f2dadc21b",
"target": {
"file": "include/linux/usb.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-b839cd21",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204610629997783010967989675556561419103",
"94283947947277431274517199611651528484",
"94973003914778820113028020336195934210",
"226998726783095117784045082188969520294",
"159631660585107629610089994411658343132",
"228988826527191883158516609323320397883",
"317389211880996271111462546485860956009"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5eb850b3e8836197a38475840725260b9783e94",
"target": {
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-b9541442",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327145145816495778087710301792415105252",
"208798929782609769909459961314477298151",
"140208479920302929963579720591320218833",
"45563350771862114016186356789724294964",
"64383634714217912072974582373702303374",
"157104929172866175571085364714921905408",
"295806913365911212960595848854404566835",
"292976246214099225630051359820535089165",
"196361983391073498431556617609875481857",
"197921658545726985091245098713590906540"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df1875084898b15cbc42f712e93d7f113ae6271b",
"target": {
"function": "usb_reset_device",
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-cd49ef17",
"signature_type": "Function",
"digest": {
"length": 1506.0,
"function_hash": "87841502777393794726586215000985423473"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc9a12e12808af178c600cc485338bac2e37d2a8",
"target": {
"function": "usb_reset_device",
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-d3a1f41d",
"signature_type": "Function",
"digest": {
"length": 1506.0,
"function_hash": "87841502777393794726586215000985423473"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b29498669914c7f9afb619722421418a753d372",
"target": {
"function": "usb_reset_device",
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-e5ce7fa7",
"signature_type": "Function",
"digest": {
"length": 1506.0,
"function_hash": "87841502777393794726586215000985423473"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe3cfb7a7c8e907b312c7dbd7bf4d142b745aa8",
"target": {
"file": "drivers/usb/core/hub.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49936-f8c50e14",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"327145145816495778087710301792415105252",
"208798929782609769909459961314477298151",
"140208479920302929963579720591320218833",
"45563350771862114016186356789724294964",
"64383634714217912072974582373702303374",
"157104929172866175571085364714921905408",
"295806913365911212960595848854404566835",
"292976246214099225630051359820535089165",
"196361983391073498431556617609875481857",
"197921658545726985091245098713590906540"
]
}
}
]