CVE-2022-50145

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dmaengine: sf-pdma: Add multithread support for a DMA channel<br /> <br /> When we get a DMA channel and try to use it in multiple threads it<br /> will cause oops and hanging the system.<br /> <br /> % echo 64 &gt; /sys/module/dmatest/parameters/threads_per_chan<br /> % echo 10000 &gt; /sys/module/dmatest/parameters/iterations<br /> % echo 1 &gt; /sys/module/dmatest/parameters/run<br /> [ 89.480664] Unable to handle kernel NULL pointer dereference at virtual<br /> address 00000000000000a0<br /> [ 89.488725] Oops [#1]<br /> [ 89.494708] CPU: 2 PID: 1008 Comm: dma0chan0-copy0 Not tainted<br /> 5.17.0-rc5<br /> [ 89.509385] epc : vchan_find_desc+0x32/0x46<br /> [ 89.513553] ra : sf_pdma_tx_status+0xca/0xd6<br /> <br /> This happens because of data race. Each thread rewrite channels&amp;#39;s<br /> descriptor as soon as device_prep_dma_memcpy() is called. It leads to the<br /> situation when the driver thinks that it uses right descriptor that<br /> actually is freed or substituted for other one.<br /> <br /> With current fixes a descriptor changes its value only when it has<br /> been used. A new descriptor is acquired from vc-&gt;desc_issued queue that<br /> is already filled with descriptors that are ready to be sent. Threads<br /> have no direct access to DMA channel descriptor. Now it is just possible<br /> to queue a descriptor for further processing.