CVE-2024-26806

spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks

published April 4, 2024

CVSS
—
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks

The ->runtime_suspend() and ->runtime_resume() callbacks are not

expected to call spi_controller_suspend() and spi_controller_resume().

Remove calls to those in the cadence-qspi driver.

Those helpers have two roles currently:

- They stop/start the queue, including dealing with the kworker.

- They toggle the SPI controller SPI_CONTROLLER_SUSPENDED flag. It

requires acquiring ctlr->bus_lock_mutex.

Step one is irrelevant because cadence-qspi is not queued. Step two

however has two implications:

- A deadlock occurs, because ->runtime_resume() is called in a context

where the lock is already taken (in the ->exec_op() callback, where

the usage count is incremented).

- It would disallow all operations once the device is auto-suspended.

Here is a brief call tree highlighting the mutex deadlock:

spi_mem_exec_op()

...

spi_mem_access_start()

mutex_lock(&ctlr->bus_lock_mutex)

cqspi_exec_mem_op()

pm_runtime_resume_and_get()

cqspi_resume()

spi_controller_resume()

mutex_lock(&ctlr->bus_lock_mutex)

...

spi_mem_access_end()

mutex_unlock(&ctlr->bus_lock_mutex)

...

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00149 · 3.7th percentile
Published
2024-04-04T08:20Z
EPSS history
Timeline
  • 04 APR 08:20Z
    spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks
    cvelistv5