From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 044DF20D513 for ; Wed, 26 Feb 2025 02:12:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535976; cv=none; b=ti83V9WZLt7xsAGAHTp/8JVht8c3YQwGozqaphwq2c5U+vZlroRNBJyzsWKk6zasf+MLO+B2dLnIIrD9+zP6NkhZAcyYnOxujdS9CpbvbrwcTdRoyzklD1Hp+wbAF1tq2Nq+DnjcbQF1Ah6cHBryp+/1RjaHr5SBCQz1OGZNr4o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740535976; c=relaxed/simple; bh=PMIg2G6AaGw5wmKaj1cvrL7T+tpRLYCya5i/UuVTK7s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Tg6BGn0JJzOphKR/T7B3DaZeq0J/yxZI4hi0/ETXj0E1NF1Z1KywYXV1yyeGEP5V3Qi+3qtXbWksB49swUADwrHEVmuDFKJ8+jhk+kJjWU7hm552USn4XKbiasWUIMS2ZvTtjcnXNQhDnBUTqg4z2sdCh8n1Y/s3XD4UZCOAbPc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=i608WjB9; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="i608WjB9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 66843C4CEDD; Wed, 26 Feb 2025 02:12:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740535975; bh=PMIg2G6AaGw5wmKaj1cvrL7T+tpRLYCya5i/UuVTK7s=; h=From:To:Cc:Subject:Date:Reply-to:From; b=i608WjB9RRIfs1b9yzMi3WadiXMb3NItMbDb2IwE4FGtusbgYZcv5q2rS/olnQFSn WXj90DT1+dPtALiniu2ihGeP1lVNIRVdWZtPJu+UwVjxdtzp/ccLuSb4KQVDmlobAr fdco8aEj71wOMV6XTWfd1UN3Zt9eC/sVnRfILy+E= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type Date: Wed, 26 Feb 2025 03:09:54 +0100 Message-ID: <2025022637-CVE-2022-49320-c76e@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3008; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=PMIg2G6AaGw5wmKaj1cvrL7T+tpRLYCya5i/UuVTK7s=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yh+G/paJ1L1yS+xiy/p7h1V+72g5lJrvYCw3TUmku 0X3QhNLRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEykW5phDp/xuerlJe/MlzX/ qkti2f7KOPRyN8OCjRr/lr7xDV+z8+PRE2XfrsctDTfoBAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type In zynqmp_dma_alloc/free_chan_resources functions there is a potential overflow in the below expressions. dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL); dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p); The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though this overflow condition is not observed but it is a potential problem in the case of 32-bit multiplication. Hence fix it by changing the desc_size data type to size_t. In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in dma_alloc_coherent API argument. Addresses-Coverity: Event overflow_before_widen. The Linux kernel CVE team has assigned CVE-2022-49320 to this issue. Affected and fixed versions =========================== Fixed in 5.4.198 with commit 83960276ffc9bf5570d4106490346b61e61be5f3 Fixed in 5.10.122 with commit 95a0ba85c1b51b36e909841c02d205cd223ab753 Fixed in 5.15.47 with commit 7b5488f4721fed6e121e661e165bab06ae2f8675 Fixed in 5.17.15 with commit 4838969e4d95d2bd2995d1605b20d3144fcb3e74 Fixed in 5.18.4 with commit 90aefae2e3a770a6909d339f5d8a988c0b0ceaf0 Fixed in 5.19 with commit f9a9f43a62a04ec3183fb0da9226c7706eed0115 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49320 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/dma/xilinx/zynqmp_dma.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3 https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753 https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675 https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74 https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0 https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115