CVE-2022-50774

{
  "id": "CVE-2022-50774",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d370cec3219490656d72f5ae6e5df32c113c5a44",
              "lessThan": "426d5bc089e7731e36b514d1beca19e777a2d653",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d370cec3219490656d72f5ae6e5df32c113c5a44",
              "lessThan": "1f1ab76e251521bd2fa5244473efcf663792745d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d370cec3219490656d72f5ae6e5df32c113c5a44",
              "lessThan": "429348d4f675e9eb418d0829064c4d7d06bd66a3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d370cec3219490656d72f5ae6e5df32c113c5a44",
              "lessThan": "c4c9d9edf4848aed89516b23b88950b194beff6a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d370cec3219490656d72f5ae6e5df32c113c5a44",
              "lessThan": "cf5bb835b7c8a5fee7f26455099cca7feb57f5e9",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/crypto/qat/qat_common/qat_algs.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver",
              "lessThanOrEqual": "5.19.*"
            },
            {
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/crypto/qat/qat_common/qat_algs.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-24T13:16:04.230",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1f1ab76e251521bd2fa5244473efcf663792745d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/426d5bc089e7731e36b514d1beca19e777a2d653",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/429348d4f675e9eb418d0829064c4d7d06bd66a3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c4c9d9edf4848aed89516b23b88950b194beff6a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cf5bb835b7c8a5fee7f26455099cca7feb57f5e9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix DMA transfer direction\n\nWhen CONFIG_DMA_API_DEBUG is selected, while running the crypto self\ntest on the QAT crypto algorithms, the function add_dma_entry() reports\na warning similar to the one below, saying that overlapping mappings\nare not supported. This occurs in tests where the input and the output\nscatter list point to the same buffers (i.e. two different scatter lists\nwhich point to the same chunks of memory).\n\nThe logic that implements the mapping uses the flag DMA_BIDIRECTIONAL\nfor both the input and the output scatter lists which leads to\noverlapped write mappings. These are not supported by the DMA layer.\n\nFix by specifying the correct DMA transfer directions when mapping\nbuffers. For in-place operations where the input scatter list\nmatches the output scatter list, buffers are mapped once with\nDMA_BIDIRECTIONAL, otherwise input buffers are mapped using the flag\nDMA_TO_DEVICE and output buffers are mapped with DMA_FROM_DEVICE.\nOverlapping a read mapping with a write mapping is a valid case in\ndma-coherent devices like QAT.\nThe function that frees and unmaps the buffers, qat_alg_free_bufl()\nhas been changed accordingly to the changes to the mapping function.\n\n   DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported\n   WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270\n   ...\n   Call Trace:\n   dma_map_page_attrs+0x82/0x2d0\n   ? preempt_count_add+0x6a/0xa0\n   qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat]\n   qat_alg_aead_dec+0x71/0x250 [intel_qat]\n   crypto_aead_decrypt+0x3d/0x70\n   test_aead_vec_cfg+0x649/0x810\n   ? number+0x310/0x3a0\n   ? vsnprintf+0x2a3/0x550\n   ? scnprintf+0x42/0x70\n   ? valid_sg_divisions.constprop.0+0x86/0xa0\n   ? test_aead_vec+0xdf/0x120\n   test_aead_vec+0xdf/0x120\n   alg_test_aead+0x185/0x400\n   alg_test+0x3d8/0x500\n   ? crypto_acomp_scomp_free_ctx+0x30/0x30\n   ? __schedule+0x32a/0x12a0\n   ? ttwu_queue_wakelist+0xbf/0x110\n   ? _raw_spin_unlock_irqrestore+0x23/0x40\n   ? try_to_wake_up+0x83/0x570\n   ? _raw_spin_unlock_irqrestore+0x23/0x40\n   ? __set_cpus_allowed_ptr_locked+0xea/0x1b0\n   ? crypto_acomp_scomp_free_ctx+0x30/0x30\n   cryptomgr_test+0x27/0x50\n   kthread+0xe6/0x110\n   ? kthread_complete_and_exit+0x20/0x20\n   ret_from_fork+0x1f/0x30"
    }
  ],
  "lastModified": "2026-06-17T05:24:09.333",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}