CVE-2024-26806 spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks
A deadlock in the Cadence QSPI driver causes a system hang when runtime power management hooks incorrectly acquire a locked mutex.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26806?
CVE-2024-26806 is a medium-severity vulnerability in Linux kernel, published on 4 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks
The ->runtime_suspend() and ->runtime_resume() callbacks are not expected to call spi_controller_suspend() and spi_controller_resume(). Remove calls to those in the cadence-qspi driver.
Those helpers have two roles currently: - They stop/start the queue, including dealing with the kworker. - They toggle the SPI controller SPI_CONTROLLER_SUSPENDED flag. It requires acquiring ctlr->bus_lock_mutex.
Step one is irrelevant because cadence-qspi is not queued. Step two however has two implications: - A deadlock occurs, because ->runtime_resume() is called in a context where the lock is already taken (in the ->exec_op() callback, where the usage count is incremented). - It would disallow all operations once the device is auto-suspended.
Here is a brief call tree highlighting the mutex deadlock:
spi_mem_exec_op() ... spi_mem_access_start() mutex_lock(&ctlr->bus_lock_mutex)
cqspi_exec_mem_op() pm_runtime_resume_and_get() cqspi_resume() spi_controller_resume() mutex_lock(&ctlr->bus_lock_mutex) ...
spi_mem_access_end() mutex_unlock(&ctlr->bus_lock_mutex) ...
Weakness: CWE-667
Which versions are affected by CVE-2024-26806?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26806?
Apply the vendor's patch.
Is CVE-2024-26806 being exploited?
There is no known exploitation of CVE-2024-26806 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26806, DEBIAN-CVE-2024-26806, GHSA-w94f-xh79-q24v, UBUNTU-CVE-2024-26806.