spi: tegra210-quad: Fix timeout handling
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.1%
exploitation probability
0.1%top 96% of all CVEs
observed exploitation
nono source reports it
In the Linux kernel, the following vulnerability has been resolved:
spi: tegra210-quad: Fix timeout handling
When the CPU that the QSPI interrupt handler runs on (typically CPU 0)
is excessively busy, it can lead to rare cases of the IRQ thread not
running before the transfer timeout is reached.
While handling the timeouts, any pending transfers are cleaned up and
the message that they correspond to is marked as failed, which leaves
the curr_xfer field pointing at stale memory.
To avoid this, clear curr_xfer to NULL upon timeout and check for this
condition when the IRQ thread is finally run.
While at it, also make sure to clear interrupts on failure so that new
interrupts can be run.
A better, more involved, fix would move the interrupt clearing into a
hard IRQ handler. Ideally we would also want to signal that the IRQ
thread no longer needs to be run after the timeout is hit to avoid the
extra check for a valid transfer.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Linux · LinuxReferences
https://git.kernel.org/stable/c/01bbf25c767219b14c3235bfa85906b8d2cb8fbchttps://git.kernel.org/stable/c/551060efb156c50fe33799038ba8145418cfdeefhttps://git.kernel.org/stable/c/83309dd551cfd60a5a1a98d9cab19f435b44d46dhttps://git.kernel.org/stable/c/88db8bb7ed1bb474618acdf05ebd4f0758d244e2https://git.kernel.org/stable/c/b4e002d8a7cee3b1d70efad0e222567f92a73000https://git.kernel.org/stable/c/bb0c58be84f907285af45657c1d4847b960a12bfhttps://git.kernel.org/stable/c/c934e40246da2c5726d14e94719c514e30840df8