CVE-2023-54159

In the Linux kernel, the following vulnerability has been resolved:

usb: mtu3: fix kernel panic at qmu transfer done irq handler

When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it.

e.g. qmu done irq on cpu0 thread running on cpu1

qmudonetx() handle gpd [0] mtu3requcomplete() mtu3gadgetepdisable() unlock @mtu->lock give back request lock @mtu->lock mtu3epdisable() mtu3gpdringfree() unlock @mtu->lock lock @mtu->lock get next gpd [1]