CVE-2025-23151
bus: mhi: host: Fix race between unprepare and queue_buf
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
bus: mhi: host: Fix race between unprepare and queue_buf
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same time, resulting in a call to mhi_queue_buf() which will invoke mhi_gen_tre(). If mhi_gen_tre() runs after mhi_unprepare_from_transfer() has torn down the channel, a panic will occur due to an invalid dereference leading to a page fault. This occurs because mhi_gen_tre() does not verify the channel state after locking it. Fix this by having mhi_gen_tre() confirm the channel state is valid, or return error to avoid accessing deinitialized data. [mani: added stable tag]
Reserved 2025-01-11 | Published 2025-05-01 | Updated 2025-05-26 | Assigner Linuxgit.kernel.org/...c/899d0353ea69681f474b6bc9de32c663b89672da
git.kernel.org/...c/3e7ecf181cbdde9753204ada3883ca1704d8702b
git.kernel.org/...c/5f084993c90d9d0b4a52a349ede5120f992a7ca1
git.kernel.org/...c/a77955f7704b2a00385e232cbcc1cb06b5c7a425
git.kernel.org/...c/178e5657c8fd285125cc6743a81b513bce099760
git.kernel.org/...c/ee1fce83ed56450087309b9b74ad9bcb2b010fa6
git.kernel.org/...c/0686a818d77a431fc3ba2fab4b46bbb04e8c9380
Support options
