Linux dw-edma: DMA Descriptor Leak and UAF Fix in dw-edma-core.c

漏洞关键信息总结 漏洞概述 漏洞类型：DMA 引擎（ ）中所有描述符（descriptor）在回调函数中未被正确终止，导致资源泄漏或状态不一致。 根本原因：当 DMA 传输完成或出错时，回调函数未将已提交/已排队的描述符标记为终止状态，可能导致后续操作访问已释放或悬空的描述符。 影响范围 受影响组件：Linux 内核 DMA 引擎驱动 （DesignWare DMA 控制器驱动）。 影响版本：从 diff 上下文看，涉及 等文件，影响使用 DesignWare DMA 控制器的 SoC 平台（如 ARM 平台）。 潜在后果：描述符泄漏、内存状态不一致、可能的 use-after-free 或 double-free。 修复方案 核心修复：在回调函数中增加对描述符的终止处理，确保所有已发出和已提交的描述符在传输完成或出错时被正确终止。 关键代码变更： - 新增 函数，用于终止虚拟描述符。 - 在 中遍历并终止所有描述符。 - 在 中调用上述函数，确保所有通道上的描述符被终止。 - 在 中增加对描述符的清理逻辑。 POC/利用代码 截图中未包含明确的 POC 或利用代码，但包含以下关键修复代码片段： ```c static void dw_edma_terminate_vdesc(struct virt_dma_desc v) { list_del_init(&v->node); vchan_cookie_complete(v); vchan_terminate_vdesc(v); } static void dw_edma_terminate_vdesc_list(struct list_head head) { struct virt_dma_desc vd, vd_next; list_for_each_entry_safe(vd, vd_next, head, node) dw_edma_terminate_vdesc(vd); } static void dw_edma_terminate_all_descs(struct dw_edma_chan chan) { / Must be called with vc.lock held. / / This order must not be reversed. Cookies are assigned when descriptors are submitted, so desc.issued contains older cookies than desc.submitted. Completing desc.submitted first could move chan->vc.cookie_completed_cookie backwards when desc.issued is terminated afterwards. / dw_edma_terminate_vdesc_list(&chan->vc.desc.issued); dw_edma_terminate_vdesc_list(&chan->vc.desc.submitted); } static void dw_edma_device_caps_init(struct dw_edma_dev edma) { struct dw_edma_dev edma = (struct dw_edma_dev *)dev_get_drvdata(dev); edma->dev = dev; edma->dev = dev; edma->dev->bus = &platform_bus; edma->dev->driver = &dw_edma_driver; edma->dev->class = &dma_class; edma->dev->release = dw_edma_device_release; edma->dev->dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_BIT_MASK(32); edma->dev->coherent_dma_mask = DMA_B

Goal Reached Thanks to every supporter — we hit 100%!

Linux dw-edma: DMA Descriptor Leak and UAF Fix in dw-edma-core.c

More from this source