CVE-2024-26807: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's Cadence QuadSPI driver has been identified as CVE-2024-26807. The issue stems from incorrect pointer handling in the runtime power management hooks where both ->runtime_suspend() and ->runtime_resume() implementations incorrectly use dev_get_drvdata() to obtain pointers to both the cqspi structure and SPI controller. This vulnerability was discovered and reported in February 2024 (Kernel Git).

The vulnerability exists in the cadence-quadspi driver's runtime PM hooks where the code attempts to use dev_get_drvdata() to get both cqspi and SPI controller pointers. The issue arises because neither structure embeds the other, leading to incorrect pointer references. The struct spi_controller is allocated by devm_spi_alloc_host() with extra memory for private data to store the struct cqspi_st. While the ->probe() function correctly sets the device drvdata to the struct cqspi_st address, attempting to retrieve the SPI controller using the same method results in pointing to the wrong structure (NVD).

The vulnerability can lead to memory corruption and kernel crashes during the probe process. This occurs because the ->runtime_resume() hook is called when the device is enabled using PM runtime, which then calls spi_controller_resume() with an incorrect pointer. The exact behavior depends on memory contents, but at least one reported case resulted in a kernel crash. The issue affects all platforms using the cadence-quadspi driver (Kernel Git).

The vulnerability has been confirmed to cause system crashes in real-world scenarios, particularly on the Mobileye EyeQ5 platform where the memory corruption manifests in the cqspi->f_pdata structure. The uninitialized memory is then used as a mutex (ctlr->bus_lock_mutex) by spi_controller_suspend(), leading to system instability (Kernel Git).

A fix has been developed and committed to the Linux kernel. The solution involves correcting the pointer references in the runtime PM hooks by properly using the stored host pointer (cqspi->host) instead of attempting to retrieve it again via dev_get_drvdata(). The patch has been reviewed and approved by kernel maintainers (Kernel Git).