In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: ffs: Remove WARNON in functionfs_bind
This commit addresses an issue related to below kernel panic where paniconwarn is enabled. It is caused by the unnecessary use of WARNON in functionsfsbind, which easily leads to the following scenarios.
1.adb_write in adbd 2. UDC write via configfs ================= =====================
->usbffsopenthread() ->UDC write ->openfunctionfs() ->configfswriteiter() ->adbopen() ->gadgetdevdescUDCstore() ->adbwrite() ->usbgadgetregisterdriverowner ->driverregister() ->StartMonitor() ->busadddriver() ->adbread() ->gadgetbinddriver() <times-out without BIND event> ->configfscompositebind() ->usbaddfunction() ->openfunctionfs() ->ffsfuncbind() ->adbopen() ->functionfsbind() <ffs->state !=FFSACTIVE>
The adbopen, adbread, and adbwrite operations are invoked from the daemon, but trying to bind the function is a process that is invoked by UDC write through configfs, which opens up the possibility of a race condition between the two paths. In this race scenario, the kernel panic occurs due to the WARNON from functionfsbind when paniconwarn is enabled. This commit fixes the kernel panic by removing the unnecessary WARNON.
Kernel panic - not syncing: kernel: paniconwarn set ... [ 14.542395] Call trace: [ 14.542464] ffsfuncbind+0x1c8/0x14a8 [ 14.542468] usbaddfunction+0xcc/0x1f0 [ 14.542473] configfscompositebind+0x468/0x588 [ 14.542478] gadgetbinddriver+0x108/0x27c [ 14.542483] reallyprobe+0x190/0x374 [ 14.542488] _driverprobedevice+0xa0/0x12c [ 14.542492] driverprobedevice+0x3c/0x220 [ 14.542498] _driverattach+0x11c/0x1fc [ 14.542502] busforeachdev+0x104/0x160 [ 14.542506] driverattach+0x24/0x34 [ 14.542510] busadddriver+0x154/0x270 [ 14.542514] driverregister+0x68/0x104 [ 14.542518] usbgadgetregisterdriverowner+0x48/0xf4 [ 14.542523] gadgetdevdescUDCstore+0xf8/0x144 [ 14.542526] configfswrite_iter+0xf0/0x138
[
{
"digest": {
"length": 731.0,
"function_hash": "186201150765352464954366616824691328652"
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c",
"function": "functionfs_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea6a1498742430eb2effce0d1439ff29ef37dd7d",
"id": "CVE-2024-57913-16dfe4f0",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"230093332125269953022871026164815139636",
"42095324706451207770071231335396629169",
"30330028137797252287888102110179327696",
"232816773455683476693111997589934693057"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19fc1c83454ca9d5699e39633ec79ce26355251c",
"id": "CVE-2024-57913-42fd3cf3",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"74330433715913615516741161710871129345",
"333443205096725858929236319769800897691",
"58118985513430036587084523931844023799",
"232816773455683476693111997589934693057"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfc51e48bca475bbee984e90f33fdc537ce09699",
"id": "CVE-2024-57913-527fa868",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 772.0,
"function_hash": "47579205983181581634821349227318992477"
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c",
"function": "functionfs_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e4d32cc145955d5c56c5498a3ff057e4aafa9d1",
"id": "CVE-2024-57913-65f98254",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 731.0,
"function_hash": "186201150765352464954366616824691328652"
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c",
"function": "functionfs_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfc51e48bca475bbee984e90f33fdc537ce09699",
"id": "CVE-2024-57913-69c545e6",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"74330433715913615516741161710871129345",
"333443205096725858929236319769800897691",
"58118985513430036587084523931844023799",
"232816773455683476693111997589934693057"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8b6a18b9b66cc4c016d63132b59ce5383f7cdd2",
"id": "CVE-2024-57913-7af6f177",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 746.0,
"function_hash": "203975362895448828283918165453643538193"
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c",
"function": "functionfs_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19fc1c83454ca9d5699e39633ec79ce26355251c",
"id": "CVE-2024-57913-7b7d4939",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"74330433715913615516741161710871129345",
"333443205096725858929236319769800897691",
"58118985513430036587084523931844023799",
"232816773455683476693111997589934693057"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea6a1498742430eb2effce0d1439ff29ef37dd7d",
"id": "CVE-2024-57913-8647be3f",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"230093332125269953022871026164815139636",
"42095324706451207770071231335396629169",
"30330028137797252287888102110179327696",
"232816773455683476693111997589934693057"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f60f3600aecd9ffcd0fbc4e193694511c85b47",
"id": "CVE-2024-57913-8ccd1cc5",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 772.0,
"function_hash": "47579205983181581634821349227318992477"
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c",
"function": "functionfs_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfe60030fcd976e3546e1f73d6d0eb3fea26442e",
"id": "CVE-2024-57913-923b9f9d",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"230093332125269953022871026164815139636",
"42095324706451207770071231335396629169",
"30330028137797252287888102110179327696",
"232816773455683476693111997589934693057"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfe60030fcd976e3546e1f73d6d0eb3fea26442e",
"id": "CVE-2024-57913-ca2df8b4",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 731.0,
"function_hash": "186201150765352464954366616824691328652"
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c",
"function": "functionfs_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8b6a18b9b66cc4c016d63132b59ce5383f7cdd2",
"id": "CVE-2024-57913-cc62b759",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"230093332125269953022871026164815139636",
"42095324706451207770071231335396629169",
"30330028137797252287888102110179327696",
"232816773455683476693111997589934693057"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e4d32cc145955d5c56c5498a3ff057e4aafa9d1",
"id": "CVE-2024-57913-ebacbe3c",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 746.0,
"function_hash": "203975362895448828283918165453643538193"
},
"target": {
"file": "drivers/usb/gadget/function/f_fs.c",
"function": "functionfs_bind"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f60f3600aecd9ffcd0fbc4e193694511c85b47",
"id": "CVE-2024-57913-f5442184",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]