High · published September 18, 2024
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: altera-msgdma: properly free descriptor in msgdma_free_descriptor
Remove list_del call in msgdma_chan_desc_cleanup, this should be the role
of msgdma_free_descriptor. In consequence replace list_add_tail with
list_move_tail in msgdma_free_descriptor.
This fixes the path:
msgdma_free_chan_resources -> msgdma_free_descriptors ->
msgdma_free_desc_list -> msgdma_free_descriptor
which does not correctly free the descriptors as first nodes were not
removed from the list.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 6.1.109 | 6.1.109 |
| linux/linux_kernel | ≥ 6.2, < 6.6.50 | 6.6.50 |
| linux/linux_kernel | ≥ 6.7, < 6.10.9 | 6.10.9 |