In the Linux kernel, the following vulnerability has been resolved:
Avoid hw_desc array overrun in dw-axi-dmac
I have a use case where nrbuffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descsallocated to be 9. Since axidescput() handles the hwdesc considering the descsallocated, this scenario would result in a kernel panic (hw_desc array will be overrun).
To fix this, the proposal is to add a new member to the axidmadesc structure, where we keep the number of allocated hwdescs (axidescalloc()) and use it in axidescput() to handle the hwdesc array correctly.
Additionally I propose to remove the axichanstartfirstqueued() call after completing the transfer, since it was identified that unbalance can occur (started descriptors can be interrupted and transfer ignored due to DMA channel not being enabled).
[
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"42653759264075840022005220851406158059",
"203401913584911873821984586779680050248",
"152853405764645478603514815407098752507",
"7092776051469867931215080841615358093"
]
},
"id": "CVE-2024-40970-02b9f56c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_desc_put"
},
"digest": {
"length": 515.0,
"function_hash": "294501270511309203597384700199970178049"
},
"id": "CVE-2024-40970-0ab6c09b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd42570018f5962c10f215ad9c21274ed5d3541e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_desc_put"
},
"digest": {
"length": 515.0,
"function_hash": "294501270511309203597384700199970178049"
},
"id": "CVE-2024-40970-1ecd9bdc",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"42653759264075840022005220851406158059",
"203401913584911873821984586779680050248",
"88710348157022940817843859340658987718",
"327403994393708371447333234492125062691"
]
},
"id": "CVE-2024-40970-2e330fcb",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd42570018f5962c10f215ad9c21274ed5d3541e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_chan_block_xfer_complete"
},
"digest": {
"length": 1146.0,
"function_hash": "119813414084604719877110654176679718390"
},
"id": "CVE-2024-40970-3859b9d8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_desc_alloc"
},
"digest": {
"length": 290.0,
"function_hash": "195773509354477300343128233791782987981"
},
"id": "CVE-2024-40970-3e495fe9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_desc_alloc"
},
"digest": {
"length": 290.0,
"function_hash": "195773509354477300343128233791782987981"
},
"id": "CVE-2024-40970-6b40651a",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9004784e8d68bcd1ac1376407ba296fa28f04dbe",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"238884331919856054481593057152684639712",
"209734651518055780544622093454322262115",
"259603851375901218126488355671884186669",
"103049289096808698893473977498164627819",
"310314699313084548558500848346293318128",
"173921427881209192268432256896153428751",
"324069658397366026621265887466437882427",
"249346736003205606233459283858767146549",
"227050425996839758027720393664027927331",
"5969586206764424652193178347957710969",
"310109856930052835308815989293480095456",
"14991736003017952575409393882758105121"
]
},
"id": "CVE-2024-40970-7fe5b312",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e151ae1ee065cf4b8ce4394ddb9d9c8df6370c66",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_chan_block_xfer_complete"
},
"digest": {
"length": 1146.0,
"function_hash": "119813414084604719877110654176679718390"
},
"id": "CVE-2024-40970-7fe66cb8",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd42570018f5962c10f215ad9c21274ed5d3541e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"238884331919856054481593057152684639712",
"209734651518055780544622093454322262115",
"259603851375901218126488355671884186669",
"103049289096808698893473977498164627819",
"310314699313084548558500848346293318128",
"173921427881209192268432256896153428751",
"324069658397366026621265887466437882427",
"249346736003205606233459283858767146549",
"227050425996839758027720393664027927331",
"5969586206764424652193178347957710969",
"310109856930052835308815989293480095456",
"14991736003017952575409393882758105121"
]
},
"id": "CVE-2024-40970-80ba399b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9004784e8d68bcd1ac1376407ba296fa28f04dbe",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_desc_put"
},
"digest": {
"length": 515.0,
"function_hash": "294501270511309203597384700199970178049"
},
"id": "CVE-2024-40970-8b440a59",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9004784e8d68bcd1ac1376407ba296fa28f04dbe",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_desc_put"
},
"digest": {
"length": 515.0,
"function_hash": "294501270511309203597384700199970178049"
},
"id": "CVE-2024-40970-9ef68de1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e151ae1ee065cf4b8ce4394ddb9d9c8df6370c66",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"238884331919856054481593057152684639712",
"209734651518055780544622093454322262115",
"259603851375901218126488355671884186669",
"103049289096808698893473977498164627819",
"310314699313084548558500848346293318128",
"173921427881209192268432256896153428751",
"324069658397366026621265887466437882427",
"249346736003205606233459283858767146549",
"227050425996839758027720393664027927331",
"5969586206764424652193178347957710969",
"310109856930052835308815989293480095456",
"14991736003017952575409393882758105121"
]
},
"id": "CVE-2024-40970-a3acf74f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd42570018f5962c10f215ad9c21274ed5d3541e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"42653759264075840022005220851406158059",
"203401913584911873821984586779680050248",
"88710348157022940817843859340658987718",
"327403994393708371447333234492125062691"
]
},
"id": "CVE-2024-40970-aa8db256",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e151ae1ee065cf4b8ce4394ddb9d9c8df6370c66",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"238884331919856054481593057152684639712",
"209734651518055780544622093454322262115",
"259603851375901218126488355671884186669",
"103049289096808698893473977498164627819",
"310314699313084548558500848346293318128",
"173921427881209192268432256896153428751",
"324069658397366026621265887466437882427",
"249346736003205606233459283858767146549",
"227050425996839758027720393664027927331",
"5969586206764424652193178347957710969",
"310109856930052835308815989293480095456",
"14991736003017952575409393882758105121"
]
},
"id": "CVE-2024-40970-aa905357",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c3bb96a20cd8db3b8824b2ff08b6cde4505c7e5",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_chan_block_xfer_complete"
},
"digest": {
"length": 1146.0,
"function_hash": "119813414084604719877110654176679718390"
},
"id": "CVE-2024-40970-bce726a6",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e151ae1ee065cf4b8ce4394ddb9d9c8df6370c66",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_desc_alloc"
},
"digest": {
"length": 290.0,
"function_hash": "195773509354477300343128233791782987981"
},
"id": "CVE-2024-40970-d6097c48",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e151ae1ee065cf4b8ce4394ddb9d9c8df6370c66",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_desc_alloc"
},
"digest": {
"length": 290.0,
"function_hash": "195773509354477300343128233791782987981"
},
"id": "CVE-2024-40970-e3689ca1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd42570018f5962c10f215ad9c21274ed5d3541e",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"42653759264075840022005220851406158059",
"203401913584911873821984586779680050248",
"88710348157022940817843859340658987718",
"327403994393708371447333234492125062691"
]
},
"id": "CVE-2024-40970-fb82251e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9004784e8d68bcd1ac1376407ba296fa28f04dbe",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c",
"function": "axi_chan_block_xfer_complete"
},
"digest": {
"length": 1146.0,
"function_hash": "119813414084604719877110654176679718390"
},
"id": "CVE-2024-40970-fe79da5e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9004784e8d68bcd1ac1376407ba296fa28f04dbe",
"signature_version": "v1"
}
]