CVE-2022-50032 usb: renesas: Fix refcount leak bug

In the Linux kernel, the following vulnerability has been resolved: usb: renesas: Fix refcount leak bug In usbhsrza1hardwareinit, offindnodebyname will return a node pointer with refcount incremented. We should use ofnodeput when it is not used anymore...

CVE-2022-50029

CVE-2022-50029 affects the Linux kernel “clk: qcom: ipq8074: dont disable gcc_sleep_clk_src” issue where the USB sleep clock is disabled while the clock framework tries to disable the sleep clock source, causing a failure. The connected advisories (Unity Linux / Astra Linux / SUSE entries) descri...

CVE-2022-50028 gadgetfs: ep_io - wait until IRQ finishes

In the Linux kernel, the following vulnerability has been resolved: gadgetfs: epio - wait until IRQ finishes after usbepqueue if waitforcompletioninterruptible is interrupted we need to wait until IRQ gets finished. Otherwise complete from epiocomplete can corrupt stack...

CVE-2022-50017

In the Linux kernel, the following vulnerability has been resolved: mips: cavium-octeon: Fix missing ofnodeput in octeon2usbclocksstart We should call ofnodeput for the reference 'uctlnode' returned by ofgetparent which will increase the refcount. Otherwise, there will be a refcount leak bug...

CVE-2022-49982

CVE-2022-49982 affects the Linux kernel media driver pvrusb2. The leak arises from error handling in pvr2_hdw_create: the v4l2 device is not unregistered when control flow returns to pvr2_context_create, causing pvr2_hdw_destroy to exit early. The fix adds v4l2_device_unregister to decrement the ...

CVE-2022-49982 media: pvrusb2: fix memory leak in pvr_probe

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix memory leak in pvrprobe The error handling code in pvr2hdwcreate forgets to unregister the v4l2 device. When pvr2hdwcreate returns back to pvr2contextcreate, it calls pvr2contextdestroy to destroy context, but...

CVE-2022-49980

CVE-2022-49980 affects the Linux kernel USB gadget subsystem (udc). A race between uevent callbacks and gadget driver unregistration can cause a use-after-free in usb_udc_uevent(), when it dereferences udc->driver without holding the udc_lock mutex. If the gadget driver is unbound concurrently...

CVE-2022-49980 USB: gadget: Fix use-after-free Read in usb_udc_uevent()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usbudcuevent The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:...

CVE-2022-49980 USB: gadget: Fix use-after-free Read in usb_udc_uevent()

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usbudcuevent The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:...

CVE-2022-49980

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usbudcuevent The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug:...

CVE-2022-49944

CVE-2022-49944 : Linux kernel USB Type-C UCSI code regression caused NULL dereference when reading the power supply sysfs due to a change in error handling after the commit that added ucsi_unregister_connectors(); the stale sysfs entry remained with NULL ops. The fix is a straight revert of that ...

CVE-2022-49944 Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"

In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsiunregisterconnectors" The recent commit 87d0e2f41b8c "usb: typec: ucsi: add a common function ucsiunregisterconnectors" introduced a regression that caused NULL dereference at...

CVE-2022-49944 Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"

In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsiunregisterconnectors" The recent commit 87d0e2f41b8c "usb: typec: ucsi: add a common function ucsiunregisterconnectors" introduced a regression that caused NULL dereference at...

CVE-2022-49944

In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsiunregisterconnectors" The recent commit 87d0e2f41b8c "usb: typec: ucsi: add a common function ucsiunregisterconnectors" introduced a regression that caused NULL dereference at...

CVE-2022-49943 USB: gadget: Fix obscure lockdep violation for udc_mutex

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix obscure lockdep violation for udcmutex A recent commit expanding the scope of the udclock mutex in the gadget core managed to cause an obscure and slightly bizarre lockdep violation. In abbreviated form:...

CVE-2022-49943

In CVE-2022-49943, the Linux kernel USB gadget udc_mutex scope was too large, allowing a lockdep alert/circular locking dependency when the gadget core invoked driver bind/unbind or started/stopped a UDC. The root cause is a widened udc_lock footprint that protected udc->driver among other thi...

CVE-2022-49943 USB: gadget: Fix obscure lockdep violation for udc_mutex

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix obscure lockdep violation for udcmutex A recent commit expanding the scope of the udclock mutex in the gadget core managed to cause an obscure and slightly bizarre lockdep violation. In abbreviated form:...

CVE-2022-49943

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix obscure lockdep violation for udcmutex A recent commit expanding the scope of the udclock mutex in the gadget core managed to cause an obscure and slightly bizarre lockdep violation. In abbreviated form:...

CVE-2022-49937

CVE-2022-49937 affects the Linux kernel mceusb driver in the media subsystem. Automatic fuzzing reported a WARN due to an unusual read on endpoint 0 caused by using legacy usb_control_msg_() routines and not setting USB_DIR_IN in bRequestType. The fix converts the driver to usb_control_msg_recv()...

CVE-2022-49937 media: mceusb: Use new usb_control_msg_*() routines

In the Linux kernel, the following vulnerability has been resolved: media: mceusb: Use new usbcontrolmsg routines Automatic kernel fuzzing led to a WARN about invalid pipe direction in the mceusb driver: ------------ cut here ------------ usb 6-1: BOGUS control dir, pipe 80000380 doesn't match...