CVE-2022-50362

published 2025-09-17

CVE-2022-50362: In the Linux kernel, the following vulnerability has been resolved: dmaengine: hisilicon: Add multi-thread support for a DMA channel When we get a DMA channel…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: hisilicon: Add multi-thread support for a DMA channel

When we get a DMA channel and try to use it in multiple threads it
will cause oops and hanging the system.

% echo 100 > /sys/module/dmatest/parameters/threads_per_chan
% echo 100 > /sys/module/dmatest/parameters/iterations
% echo 1 > /sys/module/dmatest/parameters/run
[383493.327077] Unable to handle kernel paging request at virtual
address dead000000000108
[383493.335103] Mem abort info:
[383493.335103] ESR = 0x96000044
[383493.335105] EC = 0x25: DABT (current EL), IL = 32 bits
[383493.335107] SET = 0, FnV = 0
[383493.335108] EA = 0, S1PTW = 0
[383493.335109] FSC = 0x04: level 0 translation fault
[383493.335110] Data abort info:
[383493.335111] ISV = 0, ISS = 0x00000044
[383493.364739] CM = 0, WnR = 1
[383493.367793] [dead000000000108] address between user and kernel
address ranges
[383493.375021] Internal error: Oops: 96000044 [#1] PREEMPT SMP
[383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump:
loaded Tainted: GO 5.17.0-rc4+ #2
[383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT
-SSBS BTYPE=--)
[383493.465331] pc : vchan_tx_submit+0x64/0xa0
[383493.469957] lr : vchan_tx_submit+0x34/0xa0

This occurs because the transmission timed out, and that's due
to data race. Each thread rewrite channels's descriptor as soon as
device_issue_pending is called. It leads to the situation that
the driver thinks that it uses the right descriptor in interrupt
handler while channels's descriptor has been changed by other
thread. The descriptor which in fact reported interrupt will not
be handled any more, as well as its tx->callback.
That's why timeout reports.

With current fixes channels' descriptor changes it's value only
when it has been used. A new descriptor is acquired from
vc->desc_issued queue that is already filled with descriptors
that are ready to be sent. Threads have no direct access to DMA
channel descriptor. In

Affected

17 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.3-1 (bookworm)	linux 6.0.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= e9f08b65250d73ab70e79e194813f52b8d306784 < af12e209a9d559394d35875ba0e6c80407605888	af12e209a9d559394d35875ba0e6c80407605888
linux	linux	>= e9f08b65250d73ab70e79e194813f52b8d306784 < 7cb9b20941e1fb20d22d0a2f460a3d4fa417274c	7cb9b20941e1fb20d22d0a2f460a3d4fa417274c
linux	linux	>= e9f08b65250d73ab70e79e194813f52b8d306784 < d4a8ec5cc7ff5d442bd49a44f26d74b2021ba4c8	d4a8ec5cc7ff5d442bd49a44f26d74b2021ba4c8
linux	linux	>= e9f08b65250d73ab70e79e194813f52b8d306784 < f4cee0b385cd0348e071d4d80c4c13cfe547c70d	f4cee0b385cd0348e071d4d80c4c13cfe547c70d
linux	linux	>= e9f08b65250d73ab70e79e194813f52b8d306784 < 2cbb95883c990d0002a77e13d3278913ab26ad79	2cbb95883c990d0002a77e13d3278913ab26ad79
linux	linux_kernel	>= 0 < 5.10.158-1	5.10.158-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 5.11 < 5.15.75	5.15.75
linux	linux_kernel	>= 5.16 < 5.19.17	5.19.17
linux	linux_kernel	>= 5.6 < 5.10.150	5.10.150
linux	linux_kernel	>= 6.0 < 6.0.3	6.0.3
msrc	hevc_video_extension	—	—
msrc	hevc_video_extensions	—	—

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_msrc 7.8 HIGH

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.