Linux Kernel QUP SPI Controller DMA Pointer Dereference Vulnerability

A vulnerability in the Linux kernel's SPI QUP driver can lead to a null pointer dereference after a failed DMA setup. When the DMA initialization fails, the driver correctly reverts to PIO mode but neglects to clear the DMA channel pointers. This oversight can cause the driver to later dereference an error pointer or attempt to release a DMA channel multiple times, potentially leading to a use-after-free condition. The issue was identified during a review of a devres allocation conversion patch.

Impact

The vulnerability can cause a null pointer dereference, leading to a crash of the affected component or system.

Reproduction

The vulnerability can be reproduced by loading the SPI QUP driver in a scenario where the DMA setup fails. This can be simulated by modifying the driver's initialization process to intentionally cause a DMA allocation failure, while ensuring that the driver does not properly clear the DMA channel pointers before falling back to PIO mode.

Remediation

Users can apply the latest patches available in the Linux kernel stable tree to address this vulnerability.