In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dmaengine: dw-edma: Terminate all descriptors without callbacks<\/p>\n
The DMA Engine client documentation says in the “Terminate APIs” section
\nof Documentation\/driver-api\/dmaengine\/client.rst:<\/p>\n
“No callback functions will be called for any incomplete transfers.”<\/p>\n
dw-edma instead calls vchan_cookie_complete() when a deferred STOP reaches
\nthe interrupt handler. This schedules a callback for the active descriptor
\nand leaves other issued or submitted descriptors queued. A late callback
\nafter dmaengine_terminate_sync() can dereference client state that has
\nalready been freed, while leftover descriptors may later restart into
\nreused buffers or leak.<\/p>\n
Move all issued and submitted descriptors to the terminated list whenever
\ntermination completes. For a pending STOP, do this from both the DONE and
\nABORT paths. Complete their cookies in order without scheduling callbacks.<\/p>\n
A STOP can remain pending until the running transfer raises an
\ninterrupt. Make device_synchronize() wait for such a pending STOP to
\ncomplete before releasing terminated descriptors. Reuse it from
\nfree_chan_resources(), then release the remaining virt-dma resources.
\nSleep instead of busy-polling while waiting, and warn if the existing
\ntimeout expires.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dmaengine: dw-edma: Terminate all descriptors without callbacks<\/p>\n
The DMA Engine client documentation says in the “Terminate APIs” s<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25901","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}