CVE-2022-49452

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-eth: retrieve the virtual address before dma_unmap

The TSO header was DMA unmapped before the virtual address was retrieved

and then used to free the buffer. This meant that we were actually

removing the DMA map and then trying to search for it to help in

retrieving the virtual address. This lead to a invalid virtual address

being used in the kfree call.

Fix this by calling dpaa2_iova_to_virt() prior to the dma_unmap call.

[ 487.231819] Unable to handle kernel paging request at virtual address fffffd9807000008

(...)

[ 487.354061] Hardware name: SolidRun LX2160A Honeycomb (DT)

[ 487.359535] pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

[ 487.366485] pc : kfree+0xac/0x304

[ 487.369799] lr : kfree+0x204/0x304

[ 487.373191] sp : ffff80000c4eb120

[ 487.376493] x29: ffff80000c4eb120 x28: ffff662240c46400 x27: 0000000000000001

[ 487.383621] x26: 0000000000000001 x25: ffff662246da0cc0 x24:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References