Description
In the Linux kernel, the following vulnerability has been resolved: spi: bcm2835: bcm2835_spi_handle_err(): fix NULL pointer deref for non DMA transfers In case a IRQ based transfer times out the bcm2835_spi_handle_err() function is called. Since commit 1513ceee70f2 ("spi: bcm2835: Drop dma_pending flag") the TX and RX DMA transfers are unconditionally canceled, leading to NULL pointer derefs if ctlr->dma_tx or ctlr->dma_rx are not set. Fix the NULL pointer deref by checking that ctlr->dma_tx and ctlr->dma_rx are valid pointers before accessing them.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1513ceee70f2bd523e025efe0c715328e1a43ffd to < 76668d2a2f367d25ff448e6d7087406af7d7bb2baffected1513ceee70f2bd523e025efe0c715328e1a43ffd to < 684896e675edd8b669fd3e9f547c5038222d85bcaffected1513ceee70f2bd523e025efe0c715328e1a43ffd to < 58466e05390043d2805685c70f55f3f59711bdf2affected1513ceee70f2bd523e025efe0c715328e1a43ffd to < 49ffa473218012e765682343de2052eb4c1f06a7affected1513ceee70f2bd523e025efe0c715328e1a43ffd to < 4ceaa684459d414992acbefb4e4c31f2dfc50641affected
Linux Linux
Default version status: affected
5.4affected0 to < 5.4unaffected5.4.208 to ≤ 5.4.*unaffected5.10.134 to ≤ 5.10.*unaffected5.15.58 to ≤ 5.15.*unaffected5.18.15 to ≤ 5.18.*unaffected5.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/76668d2a2f367d25ff448e6d7087406af7d7bb2b ↗
- https://git.kernel.org/stable/c/684896e675edd8b669fd3e9f547c5038222d85bc ↗
- https://git.kernel.org/stable/c/58466e05390043d2805685c70f55f3f59711bdf2 ↗
- https://git.kernel.org/stable/c/49ffa473218012e765682343de2052eb4c1f06a7 ↗
- https://git.kernel.org/stable/c/4ceaa684459d414992acbefb4e4c31f2dfc50641 ↗