CVE-2024-26807

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Both cadence-quadspi ->runtime_suspend() and ->runtime_resume()

implementations start with:

struct cqspi_st *cqspi = dev_get_drvdata(dev);

struct spi_controller *host = dev_get_drvdata(dev);

This obviously cannot be correct, unless "struct cqspi_st" is the

first member of " struct spi_controller", or the other way around, but

it is not the case. "struct spi_controller" is allocated by

devm_spi_alloc_host(), which allocates an extra amount of memory for

private data, used to store "struct cqspi_st".

The ->probe() function of the cadence-quadspi driver then sets the

device drvdata to store the address of the "struct cqspi_st"

structure. Therefore:

struct cqspi_st *cqspi = dev_get_drvdata(dev);

is correct, but:

struct spi_controller *host = dev_get_drvdata(dev);

is not, as it makes "host" point not to a "struct spi_controller" but

to the same "struct cqspi_st" structure as above.

This obviously leads to bad t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References