Linux Kernel Cadence PCI Driver Null Pointer Dereference Vulnerability

A vulnerability in the Linux kernel's PCI Cadence driver can lead to a null pointer dereference. This issue arises because the 'cdns_pcie::ops' structure may not be initialized by all Cadence glue drivers, including those for the upcoming Sophgo platform. The lack of initialization can cause a null pointer dereference when the driver attempts to access certain operations. The vulnerability has been addressed by adding a check to ensure that 'cdns_pcie::ops' is not null before use.

Impact

Exploitation of this vulnerability can cause a null pointer dereference, leading to a crash of the affected component or system.

Reproduction

The vulnerability can be reproduced by using a Cadence PCI driver on a platform that does not initialize the 'cdns_pcie::ops' structure, such as the upcoming Sophgo platform. When the driver attempts to access operations through 'cdns_pcie::ops', it will encounter a null pointer dereference, causing a crash.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.