CVE-2022-49320
- Source
- https://cve.org/CVERecord?id=CVE-2022-49320
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49320.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-49320
- Downstream
- Related
- Published
- 2025-02-26T02:10:45Z
- Modified
- 2026-08-12T03:51:44Z
- Summary
- dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
In zynqmp_dma_alloc/free_chan_resources functions there is a potential overflow in the below expressions.
dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL);
dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p);
The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though this overflow condition is not observed but it is a potential problem in the case of 32-bit multiplication. Hence fix it by changing the desc_size data type to size_t.
In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in dma_alloc_coherent API argument.
Addresses-Coverity: Event overflow_before_widen.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49320.json" }- References
-
- https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74
- https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675
- https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3
- https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0
- https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753
- https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49320.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-49320
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedb0cc417c1637192be658e68a74c8d1568e3d35f6Fixed83960276ffc9bf5570d4106490346b61e61be5f3Fixed95a0ba85c1b51b36e909841c02d205cd223ab753Fixed7b5488f4721fed6e121e661e165bab06ae2f8675Fixed4838969e4d95d2bd2995d1605b20d3144fcb3e74Fixed90aefae2e3a770a6909d339f5d8a988c0b0ceaf0Fixedf9a9f43a62a04ec3183fb0da9226c7706eed0115
Linux / Kernel
Package
- Name
- Kernel