cve/published/2022/CVE-2022-49320.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

In zynqmp_dma_alloc/free_chan_resources functions there is a
potential overflow in the below expressions.

dma_alloc_coherent(chan->dev, (2 * chan->desc_size *
		   ZYNQMP_DMA_NUM_DESCS),
		   &chan->desc_pool_p, GFP_KERNEL);

dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *
                 ZYNQMP_DMA_NUM_DESCS),
                chan->desc_pool_v, chan->desc_pool_p);

The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though
this overflow condition is not observed but it is a potential problem
in the case of 32-bit multiplication. Hence fix it by changing the
desc_size data type to size_t.

In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in
dma_alloc_coherent API argument.

Addresses-Coverity: Event overflow_before_widen.

The Linux kernel CVE team has assigned CVE-2022-49320 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.8 with commit b0cc417c1637192be658e68a74c8d1568e3d35f6 and fixed in 5.4.198 with commit 83960276ffc9bf5570d4106490346b61e61be5f3
	Issue introduced in 4.8 with commit b0cc417c1637192be658e68a74c8d1568e3d35f6 and fixed in 5.10.122 with commit 95a0ba85c1b51b36e909841c02d205cd223ab753
	Issue introduced in 4.8 with commit b0cc417c1637192be658e68a74c8d1568e3d35f6 and fixed in 5.15.47 with commit 7b5488f4721fed6e121e661e165bab06ae2f8675
	Issue introduced in 4.8 with commit b0cc417c1637192be658e68a74c8d1568e3d35f6 and fixed in 5.17.15 with commit 4838969e4d95d2bd2995d1605b20d3144fcb3e74
	Issue introduced in 4.8 with commit b0cc417c1637192be658e68a74c8d1568e3d35f6 and fixed in 5.18.4 with commit 90aefae2e3a770a6909d339f5d8a988c0b0ceaf0
	Issue introduced in 4.8 with commit b0cc417c1637192be658e68a74c8d1568e3d35f6 and fixed in 5.19 with commit f9a9f43a62a04ec3183fb0da9226c7706eed0115

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49320
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/dma/xilinx/zynqmp_dma.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3
	https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753
	https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675
	https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74
	https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0
	https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115