In the Linux kernel, the following vulnerability has been resolved:
parisc: Fix data TLB miss in sbaunmapsg
Rolf Eike Beer reported the following bug:
[1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018 [1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4 [1274934.746891] Hardware name: 9000/785/C8000 [1274934.746891] [1274934.746891] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI [1274934.746891] PSW: 00001000000001001111111000001110 Not tainted [1274934.746891] r00-03 000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000 [1274934.746891] r04-07 0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001 [1274934.746891] r08-11 0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001 [1274934.746891] r12-15 0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0 [1274934.746891] r16-19 0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007 [1274934.746891] r20-23 0000000000000006 000000004a368950 0000000000000000 0000000000000001 [1274934.746891] r24-27 0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0 [1274934.746891] r28-31 0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118 [1274934.746891] sr00-03 00000000066e5800 0000000000000000 0000000000000000 00000000066e5800 [1274934.746891] sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [1274934.746891] [1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec [1274934.746891] IIR: 48780030 ISR: 0000000000000000 IOR: 0000004140000018 [1274934.746891] CPU: 3 CR30: 00000040e3a9c000 CR31: ffffffffffffffff [1274934.746891] ORIGR28: 0000000040acdd58 [1274934.746891] RP(r2): sbaunmapsg+0xac/0x118 [1274934.746891] Backtrace: [1274934.746891] [<00000000402740cc>] dmaunmapsgattrs+0x6c/0x70 [1274934.746891] [<000000004074d6bc>] scsidmaunmap+0x54/0x60 [1274934.746891] [<00000000407a3488>] mptscsihiodone+0x150/0xd70 [1274934.746891] [<0000000040798600>] mptinterrupt+0x168/0xa68 [1274934.746891] [<0000000040255a48>] _handleirqeventpercpu+0xc8/0x278 [1274934.746891] [<0000000040255c34>] handleirqeventpercpu+0x3c/0xd8 [1274934.746891] [<000000004025ecb4>] handlepercpuirq+0xb4/0xf0 [1274934.746891] [<00000000402548e0>] generichandleirq+0x50/0x70 [1274934.746891] [<000000004019a254>] callonstack+0x18/0x24 [1274934.746891] [1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?)
The bug is caused by overrunning the sglist and incorrectly testing sgdmalen(sglist) before nents. Normally this doesn't cause a crash, but in this case sglist crossed a page boundary. This occurs in the following code:
while (sg_dma_len(sglist) && nents--) {
The fix is simply to test nents first and move the decrement of nents into the loop.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48795.json"
}[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7d6f44a0fa716a82969725516dc0b16bc7cd514",
"signature_type": "Function",
"target": {
"function": "sba_unmap_sg",
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-0735b3f9",
"digest": {
"function_hash": "324434162699676867177941328057259939192",
"length": 1107.0
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b7d6f44a0fa716a82969725516dc0b16bc7cd514",
"signature_type": "Line",
"target": {
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-08f0512a",
"digest": {
"line_hashes": [
"230828486980409926397028055405281548587",
"322483712576710555684997087907584466202",
"112276169731272700457378913124040791595",
"246190053737704631675964080905752672396",
"181070962209624949466198612194973713333",
"330729873235029523644193815187173179518",
"325726809985608243350898139203779223801",
"281103198965935374618333911557971754244"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e949ae81e7f5ab58f9f9f8e9b573b93173dd2",
"signature_type": "Line",
"target": {
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-21376f94",
"digest": {
"line_hashes": [
"230828486980409926397028055405281548587",
"322483712576710555684997087907584466202",
"112276169731272700457378913124040791595",
"246190053737704631675964080905752672396",
"181070962209624949466198612194973713333",
"330729873235029523644193815187173179518",
"325726809985608243350898139203779223801",
"281103198965935374618333911557971754244"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8f519d7df66c334b5e08f896ac70ee3b53add3b",
"signature_type": "Line",
"target": {
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-2dd39f17",
"digest": {
"line_hashes": [
"230828486980409926397028055405281548587",
"322483712576710555684997087907584466202",
"112276169731272700457378913124040791595",
"246190053737704631675964080905752672396",
"181070962209624949466198612194973713333",
"330729873235029523644193815187173179518",
"325726809985608243350898139203779223801",
"281103198965935374618333911557971754244"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f23f0444ead4d941165aa82ce2fcbb997dc00e97",
"signature_type": "Function",
"target": {
"function": "sba_unmap_sg",
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-36fb18a1",
"digest": {
"function_hash": "324434162699676867177941328057259939192",
"length": 1107.0
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c8e949ae81e7f5ab58f9f9f8e9b573b93173dd2",
"signature_type": "Function",
"target": {
"function": "sba_unmap_sg",
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-4b369296",
"digest": {
"function_hash": "324434162699676867177941328057259939192",
"length": 1107.0
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@867e50231c7605547d9334904d70a181f39f2d9e",
"signature_type": "Line",
"target": {
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-513287d5",
"digest": {
"line_hashes": [
"230828486980409926397028055405281548587",
"322483712576710555684997087907584466202",
"112276169731272700457378913124040791595",
"246190053737704631675964080905752672396",
"181070962209624949466198612194973713333",
"330729873235029523644193815187173179518",
"325726809985608243350898139203779223801",
"281103198965935374618333911557971754244"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efccc9b0c7e28d0eb7918a236e59f60dc23db4c3",
"signature_type": "Line",
"target": {
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-68ed142f",
"digest": {
"line_hashes": [
"230828486980409926397028055405281548587",
"322483712576710555684997087907584466202",
"112276169731272700457378913124040791595",
"246190053737704631675964080905752672396",
"181070962209624949466198612194973713333",
"330729873235029523644193815187173179518",
"325726809985608243350898139203779223801",
"281103198965935374618333911557971754244"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8f519d7df66c334b5e08f896ac70ee3b53add3b",
"signature_type": "Function",
"target": {
"function": "sba_unmap_sg",
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-8b1855c5",
"digest": {
"function_hash": "324434162699676867177941328057259939192",
"length": 1107.0
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efccc9b0c7e28d0eb7918a236e59f60dc23db4c3",
"signature_type": "Function",
"target": {
"function": "sba_unmap_sg",
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-98bfd2d1",
"digest": {
"function_hash": "324434162699676867177941328057259939192",
"length": 1107.0
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de75676ee99bf9f25b1124ff301b3f7b8ba597d4",
"signature_type": "Function",
"target": {
"function": "sba_unmap_sg",
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-b2e660fb",
"digest": {
"function_hash": "324434162699676867177941328057259939192",
"length": 1107.0
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e40ae3133ed87d6d526f3c8fc6a5f9a2d72dcdbf",
"signature_type": "Function",
"target": {
"function": "sba_unmap_sg",
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-bec5e01d",
"digest": {
"function_hash": "324434162699676867177941328057259939192",
"length": 1107.0
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de75676ee99bf9f25b1124ff301b3f7b8ba597d4",
"signature_type": "Line",
"target": {
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-c11e41bf",
"digest": {
"line_hashes": [
"230828486980409926397028055405281548587",
"322483712576710555684997087907584466202",
"112276169731272700457378913124040791595",
"246190053737704631675964080905752672396",
"181070962209624949466198612194973713333",
"330729873235029523644193815187173179518",
"325726809985608243350898139203779223801",
"281103198965935374618333911557971754244"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@867e50231c7605547d9334904d70a181f39f2d9e",
"signature_type": "Function",
"target": {
"function": "sba_unmap_sg",
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-c463d415",
"digest": {
"function_hash": "324434162699676867177941328057259939192",
"length": 1107.0
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f23f0444ead4d941165aa82ce2fcbb997dc00e97",
"signature_type": "Line",
"target": {
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-e07a0d39",
"digest": {
"line_hashes": [
"230828486980409926397028055405281548587",
"322483712576710555684997087907584466202",
"112276169731272700457378913124040791595",
"246190053737704631675964080905752672396",
"181070962209624949466198612194973713333",
"330729873235029523644193815187173179518",
"325726809985608243350898139203779223801",
"281103198965935374618333911557971754244"
],
"threshold": 0.9
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e40ae3133ed87d6d526f3c8fc6a5f9a2d72dcdbf",
"signature_type": "Line",
"target": {
"file": "drivers/parisc/sba_iommu.c"
},
"deprecated": false,
"id": "CVE-2022-48795-f8426250",
"digest": {
"line_hashes": [
"230828486980409926397028055405281548587",
"322483712576710555684997087907584466202",
"112276169731272700457378913124040791595",
"246190053737704631675964080905752672396",
"181070962209624949466198612194973713333",
"330729873235029523644193815187173179518",
"325726809985608243350898139203779223801",
"281103198965935374618333911557971754244"
],
"threshold": 0.9
}
}
]