CVE-2022-50145

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: sf-pdma: Add multithread support for a DMA channel

When we get a DMA channel and try to use it in multiple threads it

will cause oops and hanging the system.

% echo 64 > /sys/module/dmatest/parameters/threads_per_chan

% echo 10000 > /sys/module/dmatest/parameters/iterations

% echo 1 > /sys/module/dmatest/parameters/run

[ 89.480664] Unable to handle kernel NULL pointer dereference at virtual

address 00000000000000a0

[ 89.488725] Oops [#1]

[ 89.494708] CPU: 2 PID: 1008 Comm: dma0chan0-copy0 Not tainted

5.17.0-rc5

[ 89.509385] epc : vchan_find_desc+0x32/0x46

[ 89.513553] ra : sf_pdma_tx_status+0xca/0xd6

This happens because of data race. Each thread rewrite channels's

descriptor as soon as device_prep_dma_memcpy() is called. It leads to the

situation when the driver thinks that it uses right descriptor that

actually is freed or substituted for other one.

With curren

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References