CVE-2022-49320

dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

MEDIUM
5.5
CVSS Score
Published: February 26, 2025 at 02:10 AM UTC
Updated: June 17, 2026 at 05:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type In zynqmp_dma_alloc/free_chan_resources functions there is a potential overflow in the below expressions. dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL); dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p); The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though this overflow condition is not observed but it is a potential problem in the case of 32-bit multiplication. Hence fix it by changing the desc_size data type to size_t. In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in dma_alloc_coherent API argument. Addresses-Coverity: Event overflow_before_widen.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.8 ≤ v < 5.10.1224.8 ≤ v < 5.15.474.8 ≤ v < 5.17.154.8 ≤ v < 5.18.44.8 ≤ v < 5.194.8 ≤ v < 5.4.1985.11 ≤ v < 5.15.475.16 ≤ v < 5.17.155.18 ≤ v < 5.18.45.5 ≤ v < 5.10.1224.8b0cc417c1637192be658e68a74c8d1568e3d35f6
Vendor states this is fixed in 4838969e4d95d2bd2995d1605b20d3144fcb3e74 (fixed)
Vendor states this is fixed in 7b5488f4721fed6e121e661e165bab06ae2f8675 (fixed)
Vendor states this is fixed in 83960276ffc9bf5570d4106490346b61e61be5f3 (fixed)
Vendor states this is fixed in 90aefae2e3a770a6909d339f5d8a988c0b0ceaf0 (fixed)
Vendor states this is fixed in 95a0ba85c1b51b36e909841c02d205cd223ab753 (fixed)
Vendor states this is fixed in f9a9f43a62a04ec3183fb0da9226c7706eed0115 (fixed)
Vendor states this is fixed in 4.8 (unaffected)
Vendor states this is fixed in 5.10.122 (unaffected)
Vendor states this is fixed in 5.15.47 (unaffected)
Vendor states this is fixed in 5.17.15 (unaffected)
Vendor states this is fixed in 5.18.4 (unaffected)
Vendor states this is fixed in 5.19 (unaffected)
Vendor states this is fixed in 5.4.198 (unaffected)

References (6)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-190

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card