CVE-2022-49652: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49652 is a reference counting vulnerability discovered in the Linux kernel's DMA engine subsystem, specifically in the Texas Instruments DMA crossbar driver. The vulnerability was introduced by commit ec9bfa1e1a79 which implemented bitops instead of idr in the DMA crossbar driver (Kernel Commit).

The vulnerability stems from a reference counting issue in the ti_dra7_xbar_route_allocate function within the TI DMA crossbar driver. The function fails to properly release a reference count obtained through of_parse_phandle(), which returns a node pointer with an incremented reference count. The missing of_node_put() call in the error path leads to a reference count leak (Kernel Commit).

A reference count leak in the kernel's memory management can lead to memory resources not being properly freed, potentially causing memory exhaustion over time. This could affect system stability and performance on affected systems using the TI DMA crossbar driver.

The vulnerability requires local access to the system and the presence of the TI DMA crossbar driver. The issue occurs in an error handling path, making it less likely to be exploited in typical operations but could be triggered through specific DMA configurations.

The issue was fixed by adding the missing of_node_put(dma_spec->np) call in the error path of ti_dra7_xbar_route_allocate function. The fix was committed to the Linux kernel mainline and backported to stable kernel versions (Kernel Commit).