In the Linux kernel, the following vulnerability has been resolved:
PM: hibernate: defer device probing when resuming from hibernation
syzbot is reporting hung task at miscopen() [1], for there is a race window of AB-BA deadlock which involves probecount variable. Currently waitfordeviceprobe() from snapshotopen() from miscopen() can sleep forever with miscmtx held if probe_count cannot become 0.
When a device is probed by hubevent() work function, probecount is incremented before the probe function starts, and probe_count is decremented after the probe function completed.
There are three cases that can prevent probe_count from dropping to 0.
(a) A device being probed stopped responding (i.e. broken/malicious hardware).
(b) A process emulating a USB device using /dev/raw-gadget interface stopped responding for some reason.
(c) New device probe requests keeps coming in before existing device probe requests complete.
The phenomenon syzbot is reporting is (b). A process which is holding systemtransitionmutex and miscmtx is waiting for probecount to become 0 inside waitfordeviceprobe(), but the probe function which is called from hubevent() work function is waiting for the processes which are blocked at mutexlock(&miscmtx) to respond via /dev/raw-gadget interface.
This patch mitigates (b) by deferring waitfordeviceprobe() from snapshotopen() to snapshotwrite() and snapshotioctl(). Please note that the possibility of (b) remains as long as any thread which is emulating a USB device via /dev/raw-gadget interface can be blocked by uninterruptible blocking operations (e.g. mutex_lock()).
Please also note that (a) and (c) are not addressed. Regarding (c), we should change the code to wait for only one device which contains the image for resuming from hibernation. I don't know how to address (a), for use of timeout for waitfordevice_probe() might result in loss of user data in the image. Maybe we should require the userland to wait for the image device before opening /dev/snapshot interface.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7042cf9dd40733f387b7cac021e626c74b8856f",
"id": "CVE-2022-50202-0096112e",
"digest": {
"line_hashes": [
"60507063899783745943695931156143521361",
"333752555683253302291368233902813612045",
"261926321143117580315966410757673873432",
"25993733127646811652292182550512939771",
"178802781730756533115818076697840989557",
"3323531278887889310647630493234793335",
"174924871205142141697037015290041372601",
"331843049685675588674420379833774571350",
"74009975203091594039430920576018950173",
"222882243425750743869292500715054434515",
"206768529887157551744831274199443258811",
"326253556813560309080831968962126110579",
"169689065669695548178977312428974965504"
],
"threshold": 0.9
},
"target": {
"file": "kernel/power/user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c48d3067eaf878642276f053575a5c642600a50",
"id": "CVE-2022-50202-01012ab1",
"digest": {
"function_hash": "78805994355599520116947355432171745082",
"length": 1262.0
},
"target": {
"function": "snapshot_open",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8e1ae9433d7bd95f2dcc044a7a6f20a4c40d258",
"id": "CVE-2022-50202-012fbb37",
"digest": {
"function_hash": "161215803856844001420454753084281614202",
"length": 530.0
},
"target": {
"function": "snapshot_write",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c90947e5f1801e6c7120021c6ea0f3ad6a4eb91",
"id": "CVE-2022-50202-0670fb45",
"digest": {
"function_hash": "5794214232512949749055593981262287659",
"length": 536.0
},
"target": {
"function": "snapshot_write",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@003a456ae6f70bb97e436e02fc5105be577c1570",
"id": "CVE-2022-50202-0dd1635f",
"digest": {
"function_hash": "283674057378796788111445712291517026505",
"length": 2805.0
},
"target": {
"function": "snapshot_ioctl",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7042cf9dd40733f387b7cac021e626c74b8856f",
"id": "CVE-2022-50202-11eaac51",
"digest": {
"function_hash": "91613150888055238982307617985943706111",
"length": 1020.0
},
"target": {
"function": "snapshot_open",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c48d3067eaf878642276f053575a5c642600a50",
"id": "CVE-2022-50202-1360b0d6",
"digest": {
"function_hash": "178291048453285037095641559220311809927",
"length": 3135.0
},
"target": {
"function": "snapshot_ioctl",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a283b59bce72c05c60e9f0fa92a28b5b850d8bb",
"id": "CVE-2022-50202-21525db5",
"digest": {
"line_hashes": [
"60507063899783745943695931156143521361",
"333752555683253302291368233902813612045",
"261926321143117580315966410757673873432",
"113422393536502983718022849876539555386",
"285678547485363897090517062616774114427",
"3323531278887889310647630493234793335",
"263779496581061849616104875298580851959",
"331843049685675588674420379833774571350",
"74009975203091594039430920576018950173",
"222882243425750743869292500715054434515",
"206768529887157551744831274199443258811",
"326253556813560309080831968962126110579",
"169689065669695548178977312428974965504"
],
"threshold": 0.9
},
"target": {
"file": "kernel/power/user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c90947e5f1801e6c7120021c6ea0f3ad6a4eb91",
"id": "CVE-2022-50202-248fa97c",
"digest": {
"line_hashes": [
"60507063899783745943695931156143521361",
"333752555683253302291368233902813612045",
"261926321143117580315966410757673873432",
"113422393536502983718022849876539555386",
"285678547485363897090517062616774114427",
"3323531278887889310647630493234793335",
"263779496581061849616104875298580851959",
"331843049685675588674420379833774571350",
"74009975203091594039430920576018950173",
"222882243425750743869292500715054434515",
"206768529887157551744831274199443258811",
"326253556813560309080831968962126110579",
"169689065669695548178977312428974965504"
],
"threshold": 0.9
},
"target": {
"file": "kernel/power/user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@003a456ae6f70bb97e436e02fc5105be577c1570",
"id": "CVE-2022-50202-2f947105",
"digest": {
"line_hashes": [
"60507063899783745943695931156143521361",
"333752555683253302291368233902813612045",
"261926321143117580315966410757673873432",
"25993733127646811652292182550512939771",
"178802781730756533115818076697840989557",
"3323531278887889310647630493234793335",
"174924871205142141697037015290041372601",
"331843049685675588674420379833774571350",
"74009975203091594039430920576018950173",
"222882243425750743869292500715054434515",
"206768529887157551744831274199443258811",
"326253556813560309080831968962126110579",
"169689065669695548178977312428974965504"
],
"threshold": 0.9
},
"target": {
"file": "kernel/power/user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7042cf9dd40733f387b7cac021e626c74b8856f",
"id": "CVE-2022-50202-37ee72e9",
"digest": {
"function_hash": "161215803856844001420454753084281614202",
"length": 530.0
},
"target": {
"function": "snapshot_write",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8386c414e27caba8501119948e9551e52b527f59",
"id": "CVE-2022-50202-3d18a944",
"digest": {
"function_hash": "91613150888055238982307617985943706111",
"length": 1020.0
},
"target": {
"function": "snapshot_open",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c48d3067eaf878642276f053575a5c642600a50",
"id": "CVE-2022-50202-4111af60",
"digest": {
"function_hash": "5794214232512949749055593981262287659",
"length": 536.0
},
"target": {
"function": "snapshot_write",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0e18e0db42f4f8bc87d3d98333680065ceeff8",
"id": "CVE-2022-50202-469d1375",
"digest": {
"function_hash": "91613150888055238982307617985943706111",
"length": 1020.0
},
"target": {
"function": "snapshot_open",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8386c414e27caba8501119948e9551e52b527f59",
"id": "CVE-2022-50202-600578c1",
"digest": {
"function_hash": "283674057378796788111445712291517026505",
"length": 2805.0
},
"target": {
"function": "snapshot_ioctl",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8e1ae9433d7bd95f2dcc044a7a6f20a4c40d258",
"id": "CVE-2022-50202-625f31b9",
"digest": {
"function_hash": "283674057378796788111445712291517026505",
"length": 2805.0
},
"target": {
"function": "snapshot_ioctl",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c90947e5f1801e6c7120021c6ea0f3ad6a4eb91",
"id": "CVE-2022-50202-871fba9c",
"digest": {
"function_hash": "188062935794563374811872430913343720256",
"length": 3172.0
},
"target": {
"function": "snapshot_ioctl",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a283b59bce72c05c60e9f0fa92a28b5b850d8bb",
"id": "CVE-2022-50202-920768da",
"digest": {
"function_hash": "233146256378255029993641076256237677793",
"length": 3202.0
},
"target": {
"function": "snapshot_ioctl",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0e18e0db42f4f8bc87d3d98333680065ceeff8",
"id": "CVE-2022-50202-9c24e0dc",
"digest": {
"line_hashes": [
"60507063899783745943695931156143521361",
"333752555683253302291368233902813612045",
"261926321143117580315966410757673873432",
"25993733127646811652292182550512939771",
"178802781730756533115818076697840989557",
"3323531278887889310647630493234793335",
"174924871205142141697037015290041372601",
"331843049685675588674420379833774571350",
"74009975203091594039430920576018950173",
"222882243425750743869292500715054434515",
"206768529887157551744831274199443258811",
"326253556813560309080831968962126110579",
"169689065669695548178977312428974965504"
],
"threshold": 0.9
},
"target": {
"file": "kernel/power/user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@003a456ae6f70bb97e436e02fc5105be577c1570",
"id": "CVE-2022-50202-9d96c8d1",
"digest": {
"function_hash": "91613150888055238982307617985943706111",
"length": 1020.0
},
"target": {
"function": "snapshot_open",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8e1ae9433d7bd95f2dcc044a7a6f20a4c40d258",
"id": "CVE-2022-50202-a0bc0486",
"digest": {
"function_hash": "91613150888055238982307617985943706111",
"length": 1020.0
},
"target": {
"function": "snapshot_open",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7042cf9dd40733f387b7cac021e626c74b8856f",
"id": "CVE-2022-50202-ada6ef1b",
"digest": {
"function_hash": "283674057378796788111445712291517026505",
"length": 2805.0
},
"target": {
"function": "snapshot_ioctl",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c48d3067eaf878642276f053575a5c642600a50",
"id": "CVE-2022-50202-b6d0fc9b",
"digest": {
"line_hashes": [
"60507063899783745943695931156143521361",
"333752555683253302291368233902813612045",
"261926321143117580315966410757673873432",
"113422393536502983718022849876539555386",
"285678547485363897090517062616774114427",
"3323531278887889310647630493234793335",
"263779496581061849616104875298580851959",
"331843049685675588674420379833774571350",
"74009975203091594039430920576018950173",
"222882243425750743869292500715054434515",
"206768529887157551744831274199443258811",
"326253556813560309080831968962126110579",
"169689065669695548178977312428974965504"
],
"threshold": 0.9
},
"target": {
"file": "kernel/power/user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c90947e5f1801e6c7120021c6ea0f3ad6a4eb91",
"id": "CVE-2022-50202-bf533b67",
"digest": {
"function_hash": "78805994355599520116947355432171745082",
"length": 1262.0
},
"target": {
"function": "snapshot_open",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a283b59bce72c05c60e9f0fa92a28b5b850d8bb",
"id": "CVE-2022-50202-c5dcb30c",
"digest": {
"function_hash": "78805994355599520116947355432171745082",
"length": 1262.0
},
"target": {
"function": "snapshot_open",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8386c414e27caba8501119948e9551e52b527f59",
"id": "CVE-2022-50202-ca605bb6",
"digest": {
"function_hash": "161215803856844001420454753084281614202",
"length": 530.0
},
"target": {
"function": "snapshot_write",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0e18e0db42f4f8bc87d3d98333680065ceeff8",
"id": "CVE-2022-50202-d246c3fd",
"digest": {
"function_hash": "5794214232512949749055593981262287659",
"length": 536.0
},
"target": {
"function": "snapshot_write",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a283b59bce72c05c60e9f0fa92a28b5b850d8bb",
"id": "CVE-2022-50202-e43e69e7",
"digest": {
"function_hash": "5794214232512949749055593981262287659",
"length": 536.0
},
"target": {
"function": "snapshot_write",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@003a456ae6f70bb97e436e02fc5105be577c1570",
"id": "CVE-2022-50202-e57c62d3",
"digest": {
"function_hash": "5794214232512949749055593981262287659",
"length": 536.0
},
"target": {
"function": "snapshot_write",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8e1ae9433d7bd95f2dcc044a7a6f20a4c40d258",
"id": "CVE-2022-50202-edf8e139",
"digest": {
"line_hashes": [
"60507063899783745943695931156143521361",
"333752555683253302291368233902813612045",
"261926321143117580315966410757673873432",
"25993733127646811652292182550512939771",
"178802781730756533115818076697840989557",
"3323531278887889310647630493234793335",
"174924871205142141697037015290041372601",
"331843049685675588674420379833774571350",
"74009975203091594039430920576018950173",
"222882243425750743869292500715054434515",
"206768529887157551744831274199443258811",
"326253556813560309080831968962126110579",
"169689065669695548178977312428974965504"
],
"threshold": 0.9
},
"target": {
"file": "kernel/power/user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8386c414e27caba8501119948e9551e52b527f59",
"id": "CVE-2022-50202-ef30e041",
"digest": {
"line_hashes": [
"60507063899783745943695931156143521361",
"333752555683253302291368233902813612045",
"261926321143117580315966410757673873432",
"25993733127646811652292182550512939771",
"178802781730756533115818076697840989557",
"3323531278887889310647630493234793335",
"174924871205142141697037015290041372601",
"331843049685675588674420379833774571350",
"74009975203091594039430920576018950173",
"222882243425750743869292500715054434515",
"206768529887157551744831274199443258811",
"326253556813560309080831968962126110579",
"169689065669695548178977312428974965504"
],
"threshold": 0.9
},
"target": {
"file": "kernel/power/user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0e18e0db42f4f8bc87d3d98333680065ceeff8",
"id": "CVE-2022-50202-f328cd58",
"digest": {
"function_hash": "283674057378796788111445712291517026505",
"length": 2805.0
},
"target": {
"function": "snapshot_ioctl",
"file": "kernel/power/user.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]