CVE-2022-49320

dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

published February 26, 2025

CVSS
—
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

In zynqmp_dma_alloc/free_chan_resources functions there is a

potential overflow in the below expressions.

dma_alloc_coherent(chan->dev, (2 * chan->desc_size *

ZYNQMP_DMA_NUM_DESCS),

&chan->desc_pool_p, GFP_KERNEL);

dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *

ZYNQMP_DMA_NUM_DESCS),

chan->desc_pool_v, chan->desc_pool_p);

The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though

this overflow condition is not observed but it is a potential problem

in the case of 32-bit multiplication. Hence fix it by changing the

desc_size data type to size_t.

In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in

dma_alloc_coherent API argument.

Addresses-Coverity: Event overflow_before_widen.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Published
2025-02-26T02:10Z
EPSS history
Timeline
  • 26 FEB 02:10Z
    dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
    cvelistv5