{"id":"DEBIAN-CVE-2023-53778","details":"In the Linux kernel, the following vulnerability has been resolved:  accel/qaic: Clean up integer overflow checking in map_user_pages()  The encode_dma() function has some validation on in_trans-\u003esize but it would be more clear to move those checks to find_and_map_user_pages().  The encode_dma() had two checks:  \tif (in_trans-\u003eaddr + in_trans-\u003esize \u003c in_trans-\u003eaddr || !in_trans-\u003esize) \t\treturn -EINVAL;  The in_trans-\u003eaddr variable is the starting address.  The in_trans-\u003esize variable is the total size of the transfer.  The transfer can occur in parts and the resources-\u003exferred_dma_size tracks how many bytes we have already transferred.  This patch introduces a new variable \"remaining\" which represents the amount we want to transfer (in_trans-\u003esize) minus the amount we have already transferred (resources-\u003exferred_dma_size).  I have modified the check for if in_trans-\u003esize is zero to instead check if in_trans-\u003esize is less than resources-\u003exferred_dma_size.  If we have already transferred more bytes than in_trans-\u003esize then there are negative bytes remaining which doesn't make sense.  If there are zero bytes remaining to be copied, just return success.  The check in encode_dma() checked that \"addr + size\" could not overflow and barring a driver bug that should work, but it's easier to check if we do this in parts.  First check that \"in_trans-\u003eaddr + resources-\u003exferred_dma_size\" is safe.  Then check that \"xfer_start_addr + remaining\" is safe.  My final concern was that we are dealing with u64 values but on 32bit systems the kmalloc() function will truncate the sizes to 32 bits.  So I calculated \"total = in_trans-\u003esize + offset_in_page(xfer_start_addr);\" and returned -EINVAL if it were \u003e= SIZE_MAX.  This will not affect 64bit systems.","modified":"2026-09-15T09:03:02.743136904Z","published":"2025-12-09T01:16:48.887Z","upstream":["CVE-2023-53778"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-53778"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53778.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.13-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53778.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}