CVE-2024-56687

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: Fix hardware lockup on first Rx endpoint request

There is a possibility that a request's callback could be invoked from

usb_ep_queue() (call trace below, supplemented with missing calls):

req->complete from usb_gadget_giveback_request

(drivers/usb/gadget/udc/core.c:999)

usb_gadget_giveback_request from musb_g_giveback

(drivers/usb/musb/musb_gadget.c:147)

musb_g_giveback from rxstate

(drivers/usb/musb/musb_gadget.c:784)

rxstate from musb_ep_restart

(drivers/usb/musb/musb_gadget.c:1169)

musb_ep_restart from musb_ep_restart_resume_work

(drivers/usb/musb/musb_gadget.c:1176)

musb_ep_restart_resume_work from musb_queue_resume_work

(drivers/usb/musb/musb_core.c:2279)

musb_queue_resume_work from musb_gadget_queue

(drivers/usb/musb/musb_gadget.c:1241)

musb_gadget_queue from usb_ep_queue

(drivers/usb/gadget/udc/core.c:300)

According to the docstring of usb_ep_queue(), this should not happen:

"Note that @r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References