Linux Kernel Cirrus EP93XX SPI Driver Error Pointer Dereference Vulnerability

A vulnerability in the Linux kernel's SPI driver for Cirrus EP93XX devices can lead to an error pointer dereference. This issue occurs because the driver does not properly clear DMA channel pointers when DMA setup fails, causing the driver to fall back on PIO mode. The problem was identified during a review of a devres allocation conversion patch.

Impact

The vulnerability can cause a denial-of-service by leading to an incorrect handling of DMA channels, potentially causing the driver to mismanage resources or fail to operate as intended.

Reproduction

The vulnerability can be reproduced by loading the SPI driver for Cirrus EP93XX devices and simulating a failure in the DMA setup process. This will trigger the driver to revert to PIO mode without properly clearing the DMA channel pointers, setting the stage for an error pointer dereference.

Remediation

Users can apply the latest patches from the Linux kernel stable tree to address this vulnerability.