CVE-2022-49313

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-49313
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49313.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49313
Downstream
Related
Published
2025-02-26T02:10:42.109Z
Modified
2026-04-11T12:43:52.204121Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
drivers: usb: host: Fix deadlock in oxu_bus_suspend()
Details

In the Linux kernel, the following vulnerability has been resolved:

drivers: usb: host: Fix deadlock in oxubussuspend()

There is a deadlock in oxubussuspend(), which is shown below:

(Thread 1) | (Thread 2) | timeraction() oxubussuspend() | modtimer() spinlockirq() //(1) | (wait a time) ... | oxuwatchdog() deltimersync() | spinlock_irq() //(2) (wait timer to stop) | ...

We hold oxu->lock in position (1) of thread 1, and use deltimersync() to wait timer to stop, but timer handler also need oxu->lock in position (2) of thread 2. As a result, oxubussuspend() will block forever.

This patch extracts deltimersync() from the protection of spinlockirq(), which could let timer handler to obtain the needed lock.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49313.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b92a78e582b1a45649143dc86e526f5824092478
Fixed
9b58d255f27b0ed6a2e43208960864d67579db58
Fixed
a3d380188bde8900c3f604e82b56572896499124
Fixed
f8242044c91cafbba9e320b0fb31abf2429a3221
Fixed
2dcec0bc142be2096af71a5703d63237127db204
Fixed
ffe9440d698274c6462d2e304562c6ddfc8c84df
Fixed
d888753872190abd18f68a7d77b9c7c367f0a7ab
Fixed
4187b291a76664a3c03d3f0d9bfadc8322881868
Fixed
b97aae8b43b718314012e8170b7e03dbfd2e7677
Fixed
4d378f2ae58138d4c55684e1d274e7dd94aa6524

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49313.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.29
Fixed
4.9.318
Type
ECOSYSTEM
Events
Introduced
4.10.0
Fixed
4.14.283
Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.247
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.198
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.122
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.47
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.17.15
Type
ECOSYSTEM
Events
Introduced
5.18.0
Fixed
5.18.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49313.json"