usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind This commit addresses an issue related to below kernel panic where panic_on_warn is enabled. It is caused by the unnecessary use of WARN_ON in functionsfs_bind, which easily leads to the following scenarios. 1.adb_write in adbd 2. UDC write via configfs ================= ===================== ->usb_ffs_open_thread() ->UDC write ->open_functionfs() ->configfs_write_iter() ->adb_open() ->gadget_dev_desc_UDC_store() ->adb_write() ->usb_gadget_register_driver_owner ->driver_register() ->StartMonitor() ->bus_add_driver() ->adb_read() ->gadget_bind_driver() ->configfs_composite_bind() ->usb_add_function() ->open_functionfs() ->ffs_func_bind() ->adb_open() ->functionfs_bind() state !=FFS_ACTIVE> The adb_open, adb_read, and adb_write operations are invoked from the daemon, but trying to bind the function is a process that is invoked by UDC write through configfs, which opens up the possibility of a race condition between the two paths. In this race scenario, the kernel panic occurs due to the WARN_ON from functionfs_bind when panic_on_warn is enabled. This commit fixes the kernel panic by removing the unnecessary WARN_ON. Kernel panic - not syncing: kernel: panic_on_warn set ... [ 14.542395] Call trace: [ 14.542464] ffs_func_bind+0x1c8/0x14a8 [ 14.542468] usb_add_function+0xcc/0x1f0 [ 14.542473] configfs_composite_bind+0x468/0x588 [ 14.542478] gadget_bind_driver+0x
CVE-2024-57913
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-57913
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"lessThan": "bfe60030fcd976e3546e1f73d6d0eb3fea26442e",
"versionType": "git"
},
{
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"lessThan": "3e4d32cc145955d5c56c5498a3ff057e4aafa9d1",
"versionType": "git"
},
{
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"lessThan": "19fc1c83454ca9d5699e39633ec79ce26355251c",
"versionType": "git"
},
{
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"lessThan": "82f60f3600aecd9ffcd0fbc4e193694511c85b47",
"versionType": "git"
},
{
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"lessThan": "ea6a1498742430eb2effce0d1439ff29ef37dd7d",
"versionType": "git"
},
{
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"lessThan": "a8b6a18b9b66cc4c016d63132b59ce5383f7cdd2",
"versionType": "git"
},
{
"status": "affected",
"version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
"lessThan": "dfc51e48bca475bbee984e90f33fdc537ce09699",
"versionType": "git"
}
],
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.35",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.290",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.234",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.177",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.125",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.72",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.10",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/usb/gadget/function/f_fs.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-57913
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #26848 · Revision 1
- Added to Heist Feed
- Publisher date