Linux Kernel NULL Pointer Dereference Vulnerability in SPI S3C64XX Driver Unbind Process

A NULL pointer dereference vulnerability has been identified in the Linux kernel's SPI S3C64XX driver. This issue arises when the DMA channel allocation is moved back to the transfer preparation function without properly removing the corresponding deallocation from the driver removal process. As a result, the erroneous DMA channel release can trigger a NULL-pointer dereference during the driver unbinding phase. This vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing a crash in the SPI S3C64XX driver.

Reproduction

The vulnerability can be reproduced by loading the SPI S3C64XX driver, which allocates DMA channels during data transfer. If the driver is then unbound without properly releasing the DMA channels, a NULL pointer dereference occurs, causing the system to crash.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.