CVE-2024-26806: 
Linux Debian vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's Cadence QSPI driver, identified as CVE-2024-26806. The issue involves improper system-wide suspend helper calls in runtime PM hooks, where the ->runtime_suspend() and ->runtime_resume() callbacks incorrectly called spi_controller_suspend() and spi_controller_resume() functions. This vulnerability was disclosed on April 4, 2024, affecting the Linux kernel's SPI subsystem (Kernel Git).

The vulnerability stems from the cadence-qspi driver making inappropriate calls to system-wide suspend helpers within runtime PM hooks. The issue involves two main components: stopping/starting the queue with kworker handling, and toggling the SPI controller SPI_CONTROLLER_SUSPENDED flag, which requires acquiring ctlr->bus_lock_mutex. The critical problem arises because the runtime_resume() is called in a context where the lock is already taken during the exec_op() callback, leading to a potential deadlock condition (Kernel Git).

The vulnerability can result in two significant issues: a deadlock condition when runtime_resume() is called in a context where the lock is already taken, and the disabling of all operations once the device is auto-suspended. This affects the system's ability to properly manage SPI controller operations and could lead to system instability (Kernel Git).

The issue has been resolved by removing the system-wide suspend helper calls from runtime PM hooks in the cadence-qspi driver. The fix involves modifying the cqspi_suspend() and cqspi_resume() functions to remove calls to spi_controller_suspend() and spi_controller_resume(), as these calls are not expected in the runtime PM callbacks (Kernel Git).