Description
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided pointer and compute a DMA address offset. When the address falls in a gap before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, corrupting the DMA address sent to the DSP. Replace find_vma() with vma_lookup(), which returns NULL when the address is not contained within any VMA.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
80f3afd72bd4149c57daf852905476b43bb47647 to < d43afc412d439ffca1567e7ca8652be22f272b3baffected80f3afd72bd4149c57daf852905476b43bb47647 to < 2d0f47e27c1fa718b29c69aa7c96a2c5161bc2c2affected80f3afd72bd4149c57daf852905476b43bb47647 to < 708c17b52c60fe7a57e73b495bdee50f58feb48caffected80f3afd72bd4149c57daf852905476b43bb47647 to < d3e26df2e8eb361e6bef096b2fd565476a1f14c4affected80f3afd72bd4149c57daf852905476b43bb47647 to < e69e306a4cccb40a73511350cb280825a556ce3caffected80f3afd72bd4149c57daf852905476b43bb47647 to < 53e06f8a3c2b085c31bf1284e2ebcb8036e99625affected80f3afd72bd4149c57daf852905476b43bb47647 to < 7ba7b30ddb04646d4d638f4d8c4718a304bbbdddaffected80f3afd72bd4149c57daf852905476b43bb47647 to < 464c6ad2aa16e1e1df9d559289199356493d1e00affected954edc466128479872731d06f026d0e71840d153affected5.1.6 to < 5.2affected
Linux Linux
Default version status: affected
5.2affected0 to < 5.2unaffected5.10.260 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.94 to ≤ 6.12.*unaffected6.18.36 to ≤ 6.18.*unaffected7.0.13 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d43afc412d439ffca1567e7ca8652be22f272b3b ↗
- https://git.kernel.org/stable/c/2d0f47e27c1fa718b29c69aa7c96a2c5161bc2c2 ↗
- https://git.kernel.org/stable/c/708c17b52c60fe7a57e73b495bdee50f58feb48c ↗
- https://git.kernel.org/stable/c/d3e26df2e8eb361e6bef096b2fd565476a1f14c4 ↗
- https://git.kernel.org/stable/c/e69e306a4cccb40a73511350cb280825a556ce3c ↗
- https://git.kernel.org/stable/c/53e06f8a3c2b085c31bf1284e2ebcb8036e99625 ↗
- https://git.kernel.org/stable/c/7ba7b30ddb04646d4d638f4d8c4718a304bbbddd ↗
- https://git.kernel.org/stable/c/464c6ad2aa16e1e1df9d559289199356493d1e00 ↗