5.5

CVE-2022-49320

dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

In zynqmp_dma_alloc/free_chan_resources functions there is a
potential overflow in the below expressions.

dma_alloc_coherent(chan->dev, (2 * chan->desc_size *
		   ZYNQMP_DMA_NUM_DESCS),
		   &chan->desc_pool_p, GFP_KERNEL);

dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *
                 ZYNQMP_DMA_NUM_DESCS),
                chan->desc_pool_v, chan->desc_pool_p);

The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though
this overflow condition is not observed but it is a potential problem
in the case of 32-bit multiplication. Hence fix it by changing the
desc_size data type to size_t.

In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in
dma_alloc_coherent API argument.

Addresses-Coverity: Event overflow_before_widen.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.8 < 5.4.198
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.122
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.47
Linux ≫ Linux Kernel Version >= 5.16 < 5.17.15
Linux ≫ Linux Kernel Version >= 5.18 < 5.18.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.168
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74
Patch
https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675
Patch
https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3
Patch
https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0
Patch
https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753
Patch
https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115
Patch