CVE-2023-53475
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-53475
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53475.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-53475
- Downstream
- Related
- Published
- 2025-10-01T11:42:44Z
- Modified
- 2025-10-16T18:36:27.134206Z
- Summary
- usb: xhci: tegra: fix sleep in atomic call
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: tegra: fix sleep in atomic call
When we set the dual-role port to Host mode, we observed the following splat: [ 167.057718] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:229 [ 167.057872] Workqueue: events tegraxusbusbphywork [ 167.057954] Call trace: [ 167.057962] dumpbacktrace+0x0/0x210 [ 167.057996] showstack+0x30/0x50 [ 167.058020] dumpstacklvl+0x64/0x84 [ 167.058065] dumpstack+0x14/0x34 [ 167.058100] _mightresched+0x144/0x180 [ 167.058140] _mightsleep+0x64/0xd0 [ 167.058171] slabpreallochook.constprop.0+0xa8/0x110 [ 167.058202] _kmalloctrackcaller+0x74/0x2b0 [ 167.058233] kvasprintf+0xa4/0x190 [ 167.058261] kasprintf+0x58/0x90 [ 167.058285] tegraxusbfindportnode.isra.0+0x58/0xd0 [ 167.058334] tegraxusbfindport+0x38/0xa0 [ 167.058380] tegraxusbpadctlgetusb3companion+0x38/0xd0 [ 167.058430] tegraxhciidnotify+0x8c/0x1e0 [ 167.058473] notifiercallchain+0x88/0x100 [ 167.058506] atomicnotifiercallchain+0x44/0x70 [ 167.058537] tegraxusbusbphywork+0x60/0xd0 [ 167.058581] processonework+0x1dc/0x4c0 [ 167.058618] workerthread+0x54/0x410 [ 167.058650] kthread+0x188/0x1b0 [ 167.058672] retfromfork+0x10/0x20
The function tegraxusbpadctlgetusb3companion eventually calls tegraxusbfindport and this in turn calls kasprintf which might sleep and so cannot be called from an atomic context.
Fix this by moving the call to tegraxusbpadctlgetusb3companion to the tegraxhciidwork function where it is really needed.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/1122474b757a5dd8b2b50008a97f33cdb10dff6e
- https://git.kernel.org/stable/c/130c61c516cd0684282a8f6ab163281d60642fc5
- https://git.kernel.org/stable/c/1fe6015aa92cc0dfd875c1d3c7c1750a1b0767d9
- https://git.kernel.org/stable/c/4c7f9d2e413dc06a157c4e5dccde84aaf4655eb3
- https://git.kernel.org/stable/c/b4b4f17aa46c025da77aed5133b08971959c9684
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf836e7843036fbf34320356e156cd4267fa5bfa2Fixedb4b4f17aa46c025da77aed5133b08971959c9684
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf836e7843036fbf34320356e156cd4267fa5bfa2Fixed1122474b757a5dd8b2b50008a97f33cdb10dff6e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf836e7843036fbf34320356e156cd4267fa5bfa2Fixed130c61c516cd0684282a8f6ab163281d60642fc5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf836e7843036fbf34320356e156cd4267fa5bfa2Fixed1fe6015aa92cc0dfd875c1d3c7c1750a1b0767d9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedf836e7843036fbf34320356e156cd4267fa5bfa2Fixed4c7f9d2e413dc06a157c4e5dccde84aaf4655eb3