title: spi: cadence-qspi: fix pointer reference in runtime PM hooks
description: In the Linux kernel, the following vulnerability has been resolved:
spi: cadence-qspi: fix pointer reference in runtime PM hooks
dev_get_drvdata() gets used to acquire the pointer to cqspi and the SPI
controller. Neither embed the other; this lead to memory corruption.
On a given platform (Mobileye EyeQ5) the memory corruption is hidden
inside cqspi->f_pdata. Also, this uninitialised memory is used as a
mutex (ctlr->bus_lock_mutex) by spi_controller_suspend().
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 2087e85bb66e, lessThan: 03f1573c9587, status: affected, versionType: git
version: 2087e85bb66e, lessThan: 34e1d5c4407c, status: affected, versionType: git
version: 2087e85bb66e, lessThan: 32ce3bb57b6b, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 6.4, status: affected
version: 0, lessThan: 6.4, status: unaffected, versionType: custom
version: 6.6.21, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.9, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
