Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' (the list head) instead of 'sg' (the current entry): for_each_sg(sgl, sg, sg_len, i) { addr = sg_dma_address(sg); avail = sg_dma_len(sgl); /* should be 'sg' */ Consequently 'avail' is always the length of the first entry. For multi-sg lists this causes out-of-bounds reads when a later entry is shorter than the first, and silent data loss when it is longer. Single-sg or uniformly-sized lists happen to mask the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 to < f448a5f5bd10d792440a1b08cf2e8f311767032daffectedc8acd6aa6bed3c0fd7898202f4ebc534db9085f2 to < 2148db529f082d6e3ca95413bf943442f4ef30ccaffectedc8acd6aa6bed3c0fd7898202f4ebc534db9085f2 to < d920c07aa6d89ec11afdb6976aafaee9563a5234affectedc8acd6aa6bed3c0fd7898202f4ebc534db9085f2 to < 4a33886057e6d127555efb022879c583e966acc5affectedc8acd6aa6bed3c0fd7898202f4ebc534db9085f2 to < 88a505330eb06128f7ce79a4c5e4832b7601b3d1affectedc8acd6aa6bed3c0fd7898202f4ebc534db9085f2 to < bae65e4925928f77824ca0103122e2ed20ef5802affectedc8acd6aa6bed3c0fd7898202f4ebc534db9085f2 to < 54ccc01012a240476edf641bf1a2b8bff54fe6aeaffectedc8acd6aa6bed3c0fd7898202f4ebc534db9085f2 to < 075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47affected
Linux Linux
Default version status: affected
3.7affected0 to < 3.7unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f448a5f5bd10d792440a1b08cf2e8f311767032d ↗
- https://git.kernel.org/stable/c/2148db529f082d6e3ca95413bf943442f4ef30cc ↗
- https://git.kernel.org/stable/c/d920c07aa6d89ec11afdb6976aafaee9563a5234 ↗
- https://git.kernel.org/stable/c/4a33886057e6d127555efb022879c583e966acc5 ↗
- https://git.kernel.org/stable/c/88a505330eb06128f7ce79a4c5e4832b7601b3d1 ↗
- https://git.kernel.org/stable/c/bae65e4925928f77824ca0103122e2ed20ef5802 ↗
- https://git.kernel.org/stable/c/54ccc01012a240476edf641bf1a2b8bff54fe6ae ↗
- https://git.kernel.org/stable/c/075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47 ↗