CVE-2023-53387

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: ufs: core: Fix device management cmd timeout flow<br /> <br /> In the UFS error handling flow, the host will send a device management cmd<br /> (NOP OUT) to the device for link recovery. If this cmd times out and<br /> clearing the doorbell fails, ufshcd_wait_for_dev_cmd() will do nothing and<br /> return. hba-&gt;dev_cmd.complete struct is not set to NULL.<br /> <br /> When this happens, if cmd has been completed by device, then we will call<br /> complete() in __ufshcd_transfer_req_compl(). Because the complete struct is<br /> allocated on the stack, the following crash will occur:<br /> <br /> ipanic_die+0x24/0x38 [mrdump]<br /> die+0x344/0x748<br /> arm64_notify_die+0x44/0x104<br /> do_debug_exception+0x104/0x1e0<br /> el1_dbg+0x38/0x54<br /> el1_sync_handler+0x40/0x88<br /> el1_sync+0x8c/0x140<br /> queued_spin_lock_slowpath+0x2e4/0x3c0<br /> __ufshcd_transfer_req_compl+0x3b0/0x1164<br /> ufshcd_trc_handler+0x15c/0x308<br /> ufshcd_host_reset_and_restore+0x54/0x260<br /> ufshcd_reset_and_restore+0x28c/0x57c<br /> ufshcd_err_handler+0xeb8/0x1b6c<br /> process_one_work+0x288/0x964<br /> worker_thread+0x4bc/0xc7c<br /> kthread+0x15c/0x264<br /> ret_from_fork+0x10/0x30