CVE-2022-50362

MEDIUM EPSS 8.2%

Published Sep 17, 20259mo ago · Modified Jun 17, 20261w ago

5.5 CVSS 3.1

Medium

Published Sep 17, 2025 9mo ago

Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: hisilicon: Add multi-thread support for a DMA channel When we get a DMA channel and try to use it in multiple threads it will cause oops and hanging the system. % echo 100 > /sys/module/dmatest/parameters/threads_per_chan % echo 100 > /sys/module/dmatest/parameters/iterations % echo 1 > /sys/module/dmatest/parameters/run [383493.327077] Unable to handle kernel paging request at virtual address dead000000000108 [383493.335103] Mem abort info: [383493.335103] ESR = 0x96000044 [383493.335105] EC = 0x25: DABT (current EL), IL = 32 bits [383493.335107] SET = 0, FnV = 0 [383493.335108] EA = 0, S1PTW = 0 [383493.335109] FSC = 0x04: level 0 translation fault [383493.335110] Data abort info: [383493.335111] ISV = 0, ISS = 0x00000044 [383493.364739] CM = 0, WnR = 1 [383493.367793] [dead000000000108] address between user and kernel address ranges [383493.375021] Internal error: Oops: 96000044 [#1] PREEMPT SMP [383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump: loaded Tainted: GO 5.17.0-rc4+ #2 [383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [383493.465331] pc : vchan_tx_submit+0x64/0xa0 [383493.469957] lr : vchan_tx_submit+0x34/0xa0 This occurs because the transmission timed out, and that's due to data race. Each thread rewrite channels's descriptor as soon as device_issue_pending is called. It leads to the situation that the driver thinks that it uses the right descriptor in interrupt handler while channels's descriptor has been changed by other thread. The descriptor which in fact reported interrupt will not be handled any more, as well as its tx->callback. That's why timeout reports. With current fixes channels' descriptor changes it's value only when it has been used. A new descriptor is acquired from vc->desc_issued queue that is already filled with descriptors that are ready to be sent. Threads have no direct access to DMA channel descriptor. In case of channel's descriptor is busy, try to submit to HW again when a descriptor is completed. In this case, vc->desc_issued may be empty when hisi_dma_start_transfer is called, so delete error reporting on this. Now it is just possible to queue a descriptor for further processing.

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

8.2% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Affected Products 4

Vendor	Product	Version	Range
linux	linux_kernel	*	≥5.6 – <5.10.150
linux	linux_kernel	*	≥5.11 – <5.15.75
linux	linux_kernel	*	≥5.16 – <5.19.17
linux	linux_kernel	*	≥6.0 – <6.0.3

References 5

git.kernel.org https://git.kernel.org/stable/c/2cbb95883c990d0002a77e13d3278913ab26ad79

Patch
git.kernel.org https://git.kernel.org/stable/c/7cb9b20941e1fb20d22d0a2f460a3d4fa417274c

Patch
git.kernel.org https://git.kernel.org/stable/c/af12e209a9d559394d35875ba0e6c80407605888

Patch
git.kernel.org https://git.kernel.org/stable/c/d4a8ec5cc7ff5d442bd49a44f26d74b2021ba4c8

Patch
git.kernel.org https://git.kernel.org/stable/c/f4cee0b385cd0348e071d4d80c4c13cfe547c70d

Patch

Remediation

git.kernel.org https://git.kernel.org/stable/c/2cbb95883c990d0002a77e13d3278913ab26ad79

Patch
git.kernel.org https://git.kernel.org/stable/c/7cb9b20941e1fb20d22d0a2f460a3d4fa417274c

Patch
git.kernel.org https://git.kernel.org/stable/c/af12e209a9d559394d35875ba0e6c80407605888

Patch
git.kernel.org https://git.kernel.org/stable/c/d4a8ec5cc7ff5d442bd49a44f26d74b2021ba4c8

Patch
git.kernel.org https://git.kernel.org/stable/c/f4cee0b385cd0348e071d4d80c4c13cfe547c70d

Patch