In the Linux kernel, the following vulnerability has been resolved:
dmaengine: sf-pdma: Add multithread support for a DMA channel
When we get a DMA channel and try to use it in multiple threads it will cause oops and hanging the system.
% echo 64 > /sys/module/dmatest/parameters/threadsperchan % echo 10000 > /sys/module/dmatest/parameters/iterations % echo 1 > /sys/module/dmatest/parameters/run [ 89.480664] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 89.488725] Oops [#1] [ 89.494708] CPU: 2 PID: 1008 Comm: dma0chan0-copy0 Not tainted 5.17.0-rc5 [ 89.509385] epc : vchanfinddesc+0x32/0x46 [ 89.513553] ra : sfpdmatx_status+0xca/0xd6
This happens because of data race. Each thread rewrite channels's descriptor as soon as deviceprepdma_memcpy() is called. It leads to the situation when the driver thinks that it uses right descriptor that actually is freed or substituted for other one.
With current fixes a descriptor changes its value only when it has been used. A new descriptor is acquired from vc->desc_issued queue that is already filled with descriptors that are ready to be sent. Threads have no direct access to DMA channel descriptor. Now it is just possible to queue a descriptor for further processing.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-071018a1",
"target": {
"function": "sf_pdma_desc_residue",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 575.0,
"function_hash": "157266763201551909405496001362673277248"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c7350b1dd8a192af844de32fc99b9e34c876fda",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-09225a33",
"target": {
"function": "sf_pdma_prep_dma_memcpy",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 681.0,
"function_hash": "308095031464964091407869530177836118804"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-0aee78f7",
"target": {
"function": "sf_pdma_alloc_desc",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 379.0,
"function_hash": "224730111474512974009921371277370408135"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a93b3f1e11971a91b6441b6d47488f4492cc113f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-0fe52552",
"target": {
"function": "sf_pdma_prep_dma_memcpy",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 681.0,
"function_hash": "308095031464964091407869530177836118804"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c7350b1dd8a192af844de32fc99b9e34c876fda",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-1070df6b",
"target": {
"function": "sf_pdma_alloc_desc",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 379.0,
"function_hash": "224730111474512974009921371277370408135"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c7350b1dd8a192af844de32fc99b9e34c876fda",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-1bbe3bc6",
"target": {
"function": "sf_pdma_issue_pending",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 254.0,
"function_hash": "123650206531936322548992831255904282560"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab2782c944e324008ef5d658f2494a9f0e3c5ac",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-1edd04ae",
"target": {
"function": "sf_pdma_alloc_desc",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 379.0,
"function_hash": "224730111474512974009921371277370408135"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a93b3f1e11971a91b6441b6d47488f4492cc113f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-23dff5d3",
"target": {
"function": "sf_pdma_alloc_desc",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 379.0,
"function_hash": "224730111474512974009921371277370408135"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-43bb58e5",
"target": {
"function": "sf_pdma_issue_pending",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 254.0,
"function_hash": "123650206531936322548992831255904282560"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-4485f5df",
"target": {
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"291961346317629786579481827788688510284",
"259162868484029396872281925351891822924",
"134368410307358463390371428521069322654",
"130682968905938741425663110520650418627",
"36940214733811331506187709535917050662",
"338248795254505079126866942448589479803",
"133241102696449361531934216098173251194",
"264585681329087023019052031063526667461",
"117699908751013805475383353504198880699",
"9215922364240650589187841304801190128",
"150471568864775350771009676651656079155",
"10231430554432292353074617226425133663",
"38995910762475930043535831514667903204",
"77294566258400885524382037001240440389",
"98946839002793939005663050652658259469",
"41624271666222266311583493131516072632",
"106760926677677456342702938689567613071",
"260531335572723160761358997432106100599",
"190141120379220575314737026160300122801",
"331732495220645818323284342151849320903",
"113983488732670049802711067244602027778",
"214989070768245599793371148163870180100",
"101905738913272632074560232588628823047",
"101869303501050161083736556485950723851",
"48039163646327896446695672228094810930",
"242786665716297373878099785436165860148",
"138138021875606873016116080087498727093",
"59986646100531878534449825456680697923",
"169663897095206341350950200360377010565",
"249102404626893933940998529720585129233",
"99775436996281610744007039574298743307",
"309820522554561127875057942296934494008"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-4baea3d3",
"target": {
"function": "sf_pdma_desc_residue",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 575.0,
"function_hash": "157266763201551909405496001362673277248"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a93b3f1e11971a91b6441b6d47488f4492cc113f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-58187100",
"target": {
"function": "sf_pdma_issue_pending",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 254.0,
"function_hash": "123650206531936322548992831255904282560"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab2782c944e324008ef5d658f2494a9f0e3c5ac",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-5ac33bef",
"target": {
"function": "sf_pdma_prep_dma_memcpy",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 681.0,
"function_hash": "308095031464964091407869530177836118804"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-5b2c164f",
"target": {
"function": "sf_pdma_prep_dma_memcpy",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 681.0,
"function_hash": "308095031464964091407869530177836118804"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a93b3f1e11971a91b6441b6d47488f4492cc113f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-5c995949",
"target": {
"function": "sf_pdma_desc_residue",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 575.0,
"function_hash": "157266763201551909405496001362673277248"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-5eef7237",
"target": {
"function": "sf_pdma_issue_pending",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 254.0,
"function_hash": "123650206531936322548992831255904282560"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a93b3f1e11971a91b6441b6d47488f4492cc113f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-664a8d25",
"target": {
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"291961346317629786579481827788688510284",
"259162868484029396872281925351891822924",
"134368410307358463390371428521069322654",
"130682968905938741425663110520650418627",
"36940214733811331506187709535917050662",
"338248795254505079126866942448589479803",
"133241102696449361531934216098173251194",
"264585681329087023019052031063526667461",
"117699908751013805475383353504198880699",
"9215922364240650589187841304801190128",
"150471568864775350771009676651656079155",
"10231430554432292353074617226425133663",
"38995910762475930043535831514667903204",
"77294566258400885524382037001240440389",
"98946839002793939005663050652658259469",
"41624271666222266311583493131516072632",
"106760926677677456342702938689567613071",
"260531335572723160761358997432106100599",
"190141120379220575314737026160300122801",
"331732495220645818323284342151849320903",
"113983488732670049802711067244602027778",
"214989070768245599793371148163870180100",
"101905738913272632074560232588628823047",
"101869303501050161083736556485950723851",
"48039163646327896446695672228094810930",
"242786665716297373878099785436165860148",
"138138021875606873016116080087498727093",
"59986646100531878534449825456680697923",
"169663897095206341350950200360377010565",
"249102404626893933940998529720585129233",
"99775436996281610744007039574298743307",
"309820522554561127875057942296934494008"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab2782c944e324008ef5d658f2494a9f0e3c5ac",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-791591bb",
"target": {
"function": "sf_pdma_issue_pending",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 254.0,
"function_hash": "123650206531936322548992831255904282560"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab2782c944e324008ef5d658f2494a9f0e3c5ac",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-835e02e7",
"target": {
"function": "sf_pdma_desc_residue",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 575.0,
"function_hash": "157266763201551909405496001362673277248"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c7350b1dd8a192af844de32fc99b9e34c876fda",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-9b693389",
"target": {
"function": "sf_pdma_donebh_tasklet",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 472.0,
"function_hash": "33831463777034141389822582311904111650"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a93b3f1e11971a91b6441b6d47488f4492cc113f",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-b1c12588",
"target": {
"function": "sf_pdma_donebh_tasklet",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 472.0,
"function_hash": "33831463777034141389822582311904111650"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-b9f7530c",
"target": {
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"291961346317629786579481827788688510284",
"259162868484029396872281925351891822924",
"134368410307358463390371428521069322654",
"130682968905938741425663110520650418627",
"36940214733811331506187709535917050662",
"338248795254505079126866942448589479803",
"133241102696449361531934216098173251194",
"264585681329087023019052031063526667461",
"117699908751013805475383353504198880699",
"9215922364240650589187841304801190128",
"150471568864775350771009676651656079155",
"10231430554432292353074617226425133663",
"38995910762475930043535831514667903204",
"77294566258400885524382037001240440389",
"98946839002793939005663050652658259469",
"41624271666222266311583493131516072632",
"106760926677677456342702938689567613071",
"260531335572723160761358997432106100599",
"190141120379220575314737026160300122801",
"331732495220645818323284342151849320903",
"113983488732670049802711067244602027778",
"214989070768245599793371148163870180100",
"101905738913272632074560232588628823047",
"101869303501050161083736556485950723851",
"48039163646327896446695672228094810930",
"242786665716297373878099785436165860148",
"138138021875606873016116080087498727093",
"59986646100531878534449825456680697923",
"169663897095206341350950200360377010565",
"249102404626893933940998529720585129233",
"99775436996281610744007039574298743307",
"309820522554561127875057942296934494008"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab2782c944e324008ef5d658f2494a9f0e3c5ac",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-c267fb2d",
"target": {
"function": "sf_pdma_donebh_tasklet",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 472.0,
"function_hash": "33831463777034141389822582311904111650"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c7350b1dd8a192af844de32fc99b9e34c876fda",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-cd9e7c97",
"target": {
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"291961346317629786579481827788688510284",
"259162868484029396872281925351891822924",
"134368410307358463390371428521069322654",
"130682968905938741425663110520650418627",
"36940214733811331506187709535917050662",
"338248795254505079126866942448589479803",
"133241102696449361531934216098173251194",
"264585681329087023019052031063526667461",
"117699908751013805475383353504198880699",
"9215922364240650589187841304801190128",
"150471568864775350771009676651656079155",
"10231430554432292353074617226425133663",
"38995910762475930043535831514667903204",
"77294566258400885524382037001240440389",
"98946839002793939005663050652658259469",
"41624271666222266311583493131516072632",
"106760926677677456342702938689567613071",
"260531335572723160761358997432106100599",
"190141120379220575314737026160300122801",
"331732495220645818323284342151849320903",
"113983488732670049802711067244602027778",
"214989070768245599793371148163870180100",
"101905738913272632074560232588628823047",
"101869303501050161083736556485950723851",
"48039163646327896446695672228094810930",
"242786665716297373878099785436165860148",
"138138021875606873016116080087498727093",
"59986646100531878534449825456680697923",
"169663897095206341350950200360377010565",
"249102404626893933940998529720585129233",
"99775436996281610744007039574298743307",
"309820522554561127875057942296934494008"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c7350b1dd8a192af844de32fc99b9e34c876fda",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-d21585e8",
"target": {
"function": "sf_pdma_desc_residue",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 575.0,
"function_hash": "157266763201551909405496001362673277248"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-d2335957",
"target": {
"function": "sf_pdma_donebh_tasklet",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 472.0,
"function_hash": "33831463777034141389822582311904111650"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-d5c75a48",
"target": {
"function": "sf_pdma_alloc_desc",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 379.0,
"function_hash": "224730111474512974009921371277370408135"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-da4bb322",
"target": {
"function": "sf_pdma_donebh_tasklet",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 472.0,
"function_hash": "33831463777034141389822582311904111650"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ab2782c944e324008ef5d658f2494a9f0e3c5ac",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-e28b93c8",
"target": {
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"291961346317629786579481827788688510284",
"259162868484029396872281925351891822924",
"134368410307358463390371428521069322654",
"130682968905938741425663110520650418627",
"36940214733811331506187709535917050662",
"338248795254505079126866942448589479803",
"133241102696449361531934216098173251194",
"264585681329087023019052031063526667461",
"117699908751013805475383353504198880699",
"9215922364240650589187841304801190128",
"150471568864775350771009676651656079155",
"10231430554432292353074617226425133663",
"38995910762475930043535831514667903204",
"77294566258400885524382037001240440389",
"98946839002793939005663050652658259469",
"41624271666222266311583493131516072632",
"106760926677677456342702938689567613071",
"260531335572723160761358997432106100599",
"190141120379220575314737026160300122801",
"331732495220645818323284342151849320903",
"113983488732670049802711067244602027778",
"214989070768245599793371148163870180100",
"101905738913272632074560232588628823047",
"101869303501050161083736556485950723851",
"48039163646327896446695672228094810930",
"242786665716297373878099785436165860148",
"138138021875606873016116080087498727093",
"59986646100531878534449825456680697923",
"169663897095206341350950200360377010565",
"249102404626893933940998529720585129233",
"99775436996281610744007039574298743307",
"309820522554561127875057942296934494008"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-50145-f31be426",
"target": {
"function": "sf_pdma_prep_dma_memcpy",
"file": "drivers/dma/sf-pdma/sf-pdma.c"
},
"digest": {
"length": 681.0,
"function_hash": "308095031464964091407869530177836118804"
},
"signature_type": "Function"
}
]