[Question] fix CVE-2022-49980 introduces deadlock in linux-5.10.y
From: Cheng Yu
Date: Tue Aug 26 2025 - 10:58:34 EST
Hello,
I noticed that the community has assigned CVE-2022-49980.
I found that the issue described by this CVE also exists
in the linux-5.10.y. Therefore, I attempted to backport
the fix patch to the linux-5.10.y, but encountered a
potential deadlock after applying the patch.
The specific call path is as follows:
usb_add_gadget [(1) mutex_lock(&udc_lock]
-> device_add
-> kobject_uevent
-> uevent_ops->uevent
-> dev->class->dev_uevent
-> usb_udc_uevent [(2) mutex_lock(&udc_lock)]
This results in repeated acquisition of udc_lock, causing
a deadlock.
Does the community have any suggestions on how to resolve
this new deadlock issue introduced by the CVE fix?
Best regards,
--
Cheng Yu