{"id":"CVE-2022-50145","state":"PUBLISHED","title":"dmaengine: sf-pdma: Add multithread support for a DMA channel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: sf-pdma: Add multithread support for a DMA channel\n\nWhen we get a DMA channel and try to use it in multiple threads it\nwill cause oops and hanging the system.\n\n% echo 64 > /sys/module/dmatest/parameters/threads_per_chan\n% echo 10000 > /sys/module/dmatest/parameters/iterations\n% echo 1 > /sys/module/dmatest/parameters/run\n[   89.480664] Unable to handle kernel NULL pointer dereference at virtual\n               address 00000000000000a0\n[   89.488725] Oops [#1]\n[   89.494708] CPU: 2 PID: 1008 Comm: dma0chan0-copy0 Not tainted\n               5.17.0-rc5\n[   89.509385] epc : vchan_find_desc+0x32/0x46\n[   89.513553]  ra : sf_pdma_tx_status+0xca/0xd6\n\nThis happens because of data race. Each thread rewrite channels's\ndescriptor as soon as device_prep_dma_memcpy() is called. It leads to the\nsituation when the driver thinks that it uses right descriptor that\nactually is freed or substituted for other one.\n\nWith current fixes a descriptor changes its value only when it has\nbeen used. A new descriptor is acquired from vc->desc_issued queue that\nis already filled with descriptors that are ready to be sent. Threads\nhave no direct access to DMA channel descriptor. Now it is just possible\nto queue a descriptor for further processing.","publishedAt":"2025-06-18T11:03:06.312Z","updatedAt":"2026-08-05T08:57:32.722Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11","versionType":"git"},{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"5ab2782c944e324008ef5d658f2494a9f0e3c5ac","versionType":"git"},{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"4c7350b1dd8a192af844de32fc99b9e34c876fda","versionType":"git"},{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"a93b3f1e11971a91b6441b6d47488f4492cc113f","versionType":"git"},{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma/sf-pdma/sf-pdma.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.137","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.61","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.18.18","status":"unaffected","lessThanOrEqual":"5.18.*","versionType":"semver"},{"version":"5.19.2","status":"unaffected","lessThanOrEqual":"5.19.*","versionType":"semver"},{"version":"6.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma/sf-pdma/sf-pdma.c"]}],"references":["https://git.kernel.org/stable/c/b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11","https://git.kernel.org/stable/c/5ab2782c944e324008ef5d658f2494a9f0e3c5ac","https://git.kernel.org/stable/c/4c7350b1dd8a192af844de32fc99b9e34c876fda","https://git.kernel.org/stable/c/a93b3f1e11971a91b6441b6d47488f4492cc113f","https://git.kernel.org/stable/c/b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50145.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50145","state":"PUBLISHED","datePublished":"2025-06-18T11:03:06.312Z","dateUpdated":"2026-08-05T08:57:32.722Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-06-18T10:57:27.424Z"},"containers":{"cna":{"title":"dmaengine: sf-pdma: Add multithread support for a DMA channel","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: sf-pdma: Add multithread support for a DMA channel\n\nWhen we get a DMA channel and try to use it in multiple threads it\nwill cause oops and hanging the system.\n\n% echo 64 > /sys/module/dmatest/parameters/threads_per_chan\n% echo 10000 > /sys/module/dmatest/parameters/iterations\n% echo 1 > /sys/module/dmatest/parameters/run\n[   89.480664] Unable to handle kernel NULL pointer dereference at virtual\n               address 00000000000000a0\n[   89.488725] Oops [#1]\n[   89.494708] CPU: 2 PID: 1008 Comm: dma0chan0-copy0 Not tainted\n               5.17.0-rc5\n[   89.509385] epc : vchan_find_desc+0x32/0x46\n[   89.513553]  ra : sf_pdma_tx_status+0xca/0xd6\n\nThis happens because of data race. Each thread rewrite channels's\ndescriptor as soon as device_prep_dma_memcpy() is called. It leads to the\nsituation when the driver thinks that it uses right descriptor that\nactually is freed or substituted for other one.\n\nWith current fixes a descriptor changes its value only when it has\nbeen used. A new descriptor is acquired from vc->desc_issued queue that\nis already filled with descriptors that are ready to be sent. Threads\nhave no direct access to DMA channel descriptor. Now it is just possible\nto queue a descriptor for further processing."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11","versionType":"git"},{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"5ab2782c944e324008ef5d658f2494a9f0e3c5ac","versionType":"git"},{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"4c7350b1dd8a192af844de32fc99b9e34c876fda","versionType":"git"},{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"a93b3f1e11971a91b6441b6d47488f4492cc113f","versionType":"git"},{"version":"6973886ad58e6b4988813331abb76ae0b364a9c2","status":"affected","lessThan":"b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma/sf-pdma/sf-pdma.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.137","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.61","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.18.18","status":"unaffected","lessThanOrEqual":"5.18.*","versionType":"semver"},{"version":"5.19.2","status":"unaffected","lessThanOrEqual":"5.19.*","versionType":"semver"},{"version":"6.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/dma/sf-pdma/sf-pdma.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b9b4992f897be9b0b9e3a3b956cab6b75ccc3f11"},{"url":"https://git.kernel.org/stable/c/5ab2782c944e324008ef5d658f2494a9f0e3c5ac"},{"url":"https://git.kernel.org/stable/c/4c7350b1dd8a192af844de32fc99b9e34c876fda"},{"url":"https://git.kernel.org/stable/c/a93b3f1e11971a91b6441b6d47488f4492cc113f"},{"url":"https://git.kernel.org/stable/c/b2cc5c465c2cb8ab697c3fd6583c614e3f6cfbcc"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in the SiFive/platform sf-pdma dmaengine driver and is reached only through local DMA channel operations (dmatest/sysfs or in-kernel DMA_MEMCPY clients such as async_tx), not via network packets or adjacent-link protocols.\nAC:L - The attacker can create the race by issuing concurrent transfers on the same channel (e.g. multiple dmatest threads or parallel async_tx/RAID memcpy submissions); both sides of the race are attacker-influenced, so success does not depend on conditions outside attacker control.\nPR:L - sf-pdma registers public DMA_MEMCPY channels (no DMA_PRIVATE), which async_tx and similar clients can share; concurrent I/O from an unprivileged local user can therefore hit the race without real root, so PR:L is the higher-severity defensible choice.\nUI:N - Exploitation requires only attacker-controlled concurrent DMA submissions; no separate victim action (mount, open, or admin confirmation) is needed.\nS:U - Impact is kernel descriptor UAF/corruption and DoS within the host kernel authority; it is not a VM escape or IOMMU boundary bypass.\nC:H - The race uses a descriptor that is freed or substituted for another transfer (commit: freed/substituted chan->desc), yielding a use-after-free/list-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Descriptor substitution/UAF enables wrong DMA address programming and heap reuse/control-flow hijacking primitives typical of kernel use-after-free exploitation, so integrity impact is High.\nA:H - The bug causes a documented kernel NULL-pointer oops in vchan_find_desc/sf_pdma_tx_status and can hang the system under multi-threaded DMA load."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:57:32.722Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.137"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.15.61"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.18.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.19.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}