CVE-2023-53287

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: Put the cdns set active part outside the spin lock

The device may be scheduled during the resume process,

so this cannot appear in atomic operations. Since

pm_runtime_set_active will resume suppliers, put set

active outside the spin lock, which is only used to

protect the struct cdns data structure, otherwise the

kernel will report the following warning:

BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1163

in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 651, name: sh

preempt_count: 1, expected: 0

RCU nest depth: 0, expected: 0

CPU: 0 PID: 651 Comm: sh Tainted: G WC 6.1.20 #1

Hardware name: Freescale i.MX8QM MEK (DT)

Call trace:

dump_backtrace.part.0+0xe0/0xf0

show_stack+0x18/0x30

dump_stack_lvl+0x64/0x80

dump_stack+0x1c/0x38

__might_resched+0x1fc/0x240

__might_sleep+0x68/0xc0

__pm_runtime_resume+0x9c/0xe0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References