In the Linux kernel, the following vulnerability has been resolved:
spi: Fix null dereference on suspend
A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes.
Example order of events leading to the exception:
- spi_sync() calls __spi_transfer_message_noqueue() which sets
- Spi transfer begins via spi_transfer_one_message()
- System is suspended interrupting the transfer context
- System is resumed
- spi_controller_resume() calls spi_start_queue() which resets cur_msg
- Spi transfer context resumes and spi_finalize_current_message() is
Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.