{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53778","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-08T23:58:35.272Z","datePublished":"2025-12-09T00:00:34.074Z","dateUpdated":"2026-05-11T19:51:21.971Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T19:51:21.971Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Clean up integer overflow checking in map_user_pages()\n\nThe encode_dma() function has some validation on in_trans->size but it\nwould be more clear to move those checks to find_and_map_user_pages().\n\nThe encode_dma() had two checks:\n\n\tif (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size)\n\t\treturn -EINVAL;\n\nThe in_trans->addr variable is the starting address.  The in_trans->size\nvariable is the total size of the transfer.  The transfer can occur in\nparts and the resources->xferred_dma_size tracks how many bytes we have\nalready transferred.\n\nThis patch introduces a new variable \"remaining\" which represents the\namount we want to transfer (in_trans->size) minus the amount we have\nalready transferred (resources->xferred_dma_size).\n\nI have modified the check for if in_trans->size is zero to instead check\nif in_trans->size is less than resources->xferred_dma_size.  If we have\nalready transferred more bytes than in_trans->size then there are negative\nbytes remaining which doesn't make sense.  If there are zero bytes\nremaining to be copied, just return success.\n\nThe check in encode_dma() checked that \"addr + size\" could not overflow\nand barring a driver bug that should work, but it's easier to check if\nwe do this in parts.  First check that \"in_trans->addr +\nresources->xferred_dma_size\" is safe.  Then check that \"xfer_start_addr +\nremaining\" is safe.\n\nMy final concern was that we are dealing with u64 values but on 32bit\nsystems the kmalloc() function will truncate the sizes to 32 bits.  So\nI calculated \"total = in_trans->size + offset_in_page(xfer_start_addr);\"\nand returned -EINVAL if it were >= SIZE_MAX.  This will not affect 64bit\nsystems."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/qaic/qaic_control.c"],"versions":[{"version":"129776ac2e38231fa9c02ce20e116c99de291666","lessThan":"d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3","status":"affected","versionType":"git"},{"version":"129776ac2e38231fa9c02ce20e116c99de291666","lessThan":"96d3c1cadedb6ae2e8965e19cd12caa244afbd9c","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/accel/qaic/qaic_control.c"],"versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","status":"unaffected","versionType":"semver"},{"version":"6.4.12","lessThanOrEqual":"6.4.*","status":"unaffected","versionType":"semver"},{"version":"6.5","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.4.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4","versionEndExcluding":"6.5"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d410a96e5cb8c1ec7049c83f2edcd8bbfaf5d9b3"},{"url":"https://git.kernel.org/stable/c/96d3c1cadedb6ae2e8965e19cd12caa244afbd9c"}],"title":"accel/qaic: Clean up integer overflow checking in map_user_pages()","x_generator":{"engine":"bippy-1.2.0"}}}}