Description
In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind). This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to < 9c6f306a8140962c7284197db54b96fdb5f468d6affectedc687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to < 3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6affectedc687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to < d6f422b122922d1abee907d673bcc990e5f3672daffectedc687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to < f2dc841d7dc9063fe9b47ced869b1271e55052aeaffectedc687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to < 1cd927002120678bd5d23c760246639caa53040eaffectedc687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to < d7a076fb596c7b408ed6df74793a597990a6d860affectedc687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to < 178b9b570c0f75fa7e691490520328b20d19138eaffectedc687c46e9e4527c4b4d82bc3cca58c1b08bcfb83 to < ea6ec3343e05f7937a53eb6d7617b3abdb4abc19affected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.142 to ≤ 6.6.*unaffected6.12.92 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected7.0.11 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9c6f306a8140962c7284197db54b96fdb5f468d6 ↗
- https://git.kernel.org/stable/c/3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6 ↗
- https://git.kernel.org/stable/c/d6f422b122922d1abee907d673bcc990e5f3672d ↗
- https://git.kernel.org/stable/c/f2dc841d7dc9063fe9b47ced869b1271e55052ae ↗
- https://git.kernel.org/stable/c/1cd927002120678bd5d23c760246639caa53040e ↗
- https://git.kernel.org/stable/c/d7a076fb596c7b408ed6df74793a597990a6d860 ↗
- https://git.kernel.org/stable/c/178b9b570c0f75fa7e691490520328b20d19138e ↗
- https://git.kernel.org/stable/c/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19 ↗