Linux Kernel Pointer Dereference Vulnerability in SPI SPRD Driver After DMA Setup Failure

A vulnerability has been addressed in the Linux kernel's SPI SPRD driver, related to improper handling of pointer dereferencing after a failed Direct Memory Access (DMA) setup. During the probe process, if the DMA configuration fails, the driver reverts to Programmed Input/Output (PIO) mode. However, the driver did not initially verify whether DMA was enabled before attempting to release the DMA channels, particularly in cases of late probe errors. This oversight could lead to dereferencing an error pointer or unnecessarily releasing a DMA channel multiple times. The issue was identified by a developer named Sashiko while reviewing a patch related to resource allocation.

Impact

The vulnerability could cause a null pointer dereference, leading to a crash or undefined behavior in the driver.

Reproduction

The vulnerability can be reproduced by probing a device with the affected SPI SPRD driver while the DMA setup fails. This can be simulated by configuring the driver to use DMA but causing the DMA setup to fail, such as by using a device that does not support DMA or by introducing an error during the DMA initialization process. Once the DMA setup fails, the driver will fall back to PIO mode, but if the dma.enabled flag is not checked before releasing the DMA channels, it can result in dereferencing an error pointer or releasing a channel that has already been freed.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version of the stable Linux kernel where this issue has been addressed.