CVE-2022-50721

Vulnerability

Overview

The Qcom-ADM DMA engine driver in the Linux kernel violates the established calling convention for the prep_slave_sg function. According to the DMA engine API, this function should return NULL on failure and log an error. However, the Qcom-ADM driver returns an error pointer (e.g., ERR_PTR(-ENOMEM)) when an error occurs [1].

Exploitation

Mechanism

This incorrect return value propagates to callers such as the NAND controller driver (nandc). The nandc driver only checks whether the pointer returned by device_prep_slave_sg is non-NULL, assuming a valid descriptor. When it receives an error pointer, it treats it as a valid descriptor and proceeds to use it, leading to a kernel panic later in the execution flow [1].

Impact

An attacker who can trigger an error condition in the Qcom-ADM driver (e.g., by exhausting memory or providing invalid parameters) can cause a denial of service via kernel panic. The vulnerability does not require special privileges beyond the ability to interact with the DMA subsystem through the NAND controller or other affected drivers.

Mitigation

The fix, committed in the Linux kernel stable tree, changes the Qcom-ADM driver to return NULL on error and log an appropriate error message, aligning with the expected calling convention [1]. Users should apply the kernel patch to prevent update to version containing commit b9d2140c3bad or later.