Skip to content
Heist/ feed
Unrated

usb: gadget: f_fs: Remove WARN_ON in functionfs_bind

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind This commit addresses an issue related to below kernel panic where panic_on_warn is enabled. It is caused by the unnecessary use of WARN_ON in functionsfs_bind, which easily leads to the following scenarios. 1.adb_write in adbd 2. UDC write via configfs ================= ===================== ->usb_ffs_open_thread() ->UDC write ->open_functionfs() ->configfs_write_iter() ->adb_open() ->gadget_dev_desc_UDC_store() ->adb_write() ->usb_gadget_register_driver_owner ->driver_register() ->StartMonitor() ->bus_add_driver() ->adb_read() ->gadget_bind_driver() ->configfs_composite_bind() ->usb_add_function() ->open_functionfs() ->ffs_func_bind() ->adb_open() ->functionfs_bind() state !=FFS_ACTIVE> The adb_open, adb_read, and adb_write operations are invoked from the daemon, but trying to bind the function is a process that is invoked by UDC write through configfs, which opens up the possibility of a race condition between the two paths. In this race scenario, the kernel panic occurs due to the WARN_ON from functionfs_bind when panic_on_warn is enabled. This commit fixes the kernel panic by removing the unnecessary WARN_ON. Kernel panic - not syncing: kernel: panic_on_warn set ... [ 14.542395] Call trace: [ 14.542464] ffs_func_bind+0x1c8/0x14a8 [ 14.542468] usb_add_function+0xcc/0x1f0 [ 14.542473] configfs_composite_bind+0x468/0x588 [ 14.542478] gadget_bind_driver+0x

Announced Source revision 1
Original source ↗

CVE-2024-57913

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-57913

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
        "lessThan": "bfe60030fcd976e3546e1f73d6d0eb3fea26442e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
        "lessThan": "3e4d32cc145955d5c56c5498a3ff057e4aafa9d1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
        "lessThan": "19fc1c83454ca9d5699e39633ec79ce26355251c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
        "lessThan": "82f60f3600aecd9ffcd0fbc4e193694511c85b47",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
        "lessThan": "ea6a1498742430eb2effce0d1439ff29ef37dd7d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
        "lessThan": "a8b6a18b9b66cc4c016d63132b59ce5383f7cdd2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ddf8abd2599491cbad959c700b90ba72a5dce8d0",
        "lessThan": "dfc51e48bca475bbee984e90f33fdc537ce09699",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/usb/gadget/function/f_fs.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.35"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.35",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.290",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.234",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.177",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.125",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.72",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.10",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.13",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/usb/gadget/function/f_fs.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-57913

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#26848 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement