In the Linux kernel, the following vulnerability has been resolved:
spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain
Previously the transfer complete IRQ immediately drained to RX FIFO to read any data remaining in FIFO to the RX buffer. This behaviour is correct when dealing with SPI in interrupt mode. However in DMA mode the transfer complete interrupt still fires as soon as all bytes to be transferred have been stored in the FIFO. At that point data in the FIFO still needs to be picked up by the DMA engine. Thus the drain procedure and DMA engine end up racing to read from RX FIFO, corrupting any data read. Additionally the RX buffer pointer is never adjusted according to DMA progress in DMA mode, thus calling the RX FIFO drain procedure in DMA mode is a bug. Fix corruptions in DMA RX mode by draining RX FIFO only in interrupt mode. Also wait for completion of RX DMA when in DMA mode before returning to ensure all data has been copied to the supplied memory buffer.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd1ec7f9983b5cd3c77e0f7cda3fa8aed041af2f",
"target": {
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"131425933237577985826043062078141760344",
"31937360783432627704232461077535642395",
"41654525368589609571487329788743598370",
"256212457306931924223134651227298409653",
"35649822893637705601260010672057139871",
"75410629399528994050716823423194022238",
"106362331640649562110592855226670164000",
"8047676467015961546395010118105520306",
"56536952967079767737655938763948298659",
"277885480404280866639976885376006155328",
"169871460419910681489245931514895623441",
"106090937937039855689027136684619674479",
"188411384432928058755581943711544486647",
"270924413691395863862570566010045037921",
"71609298317569180696373184143336878796",
"125625963166130524806266155751643494001",
"157073668765223160273837698794892868730",
"319416312464095336058745798507832076532",
"94151159567872683008524083254595783790",
"178021005810485375643271412518959182388",
"244258666601527579462625340883661685680",
"315684594142265065737754382486992203604",
"218926164412793576252905662739054862042",
"8824642596359033041929743967909806366",
"31364127245495076710607035238484810268",
"221387399358062781315339517109735544016",
"6934823973418143191733515332229025840"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52517-17a7d101"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f11f4202caf5710204d334fe63392052783876d",
"target": {
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"131425933237577985826043062078141760344",
"31937360783432627704232461077535642395",
"41654525368589609571487329788743598370",
"256212457306931924223134651227298409653",
"35649822893637705601260010672057139871",
"75410629399528994050716823423194022238",
"106362331640649562110592855226670164000",
"8047676467015961546395010118105520306",
"56536952967079767737655938763948298659",
"277885480404280866639976885376006155328",
"169871460419910681489245931514895623441",
"106090937937039855689027136684619674479",
"188411384432928058755581943711544486647",
"270924413691395863862570566010045037921",
"71609298317569180696373184143336878796",
"123280156922784120154317241799613959502",
"157073668765223160273837698794892868730",
"319416312464095336058745798507832076532",
"94151159567872683008524083254595783790",
"178021005810485375643271412518959182388",
"244258666601527579462625340883661685680",
"315684594142265065737754382486992203604",
"218926164412793576252905662739054862042",
"8824642596359033041929743967909806366",
"31364127245495076710607035238484810268",
"221387399358062781315339517109735544016",
"6934823973418143191733515332229025840"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52517-2585e034"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36b29974a7ad2ff604c24ad348f940506c7b1209",
"target": {
"function": "sun6i_spi_prepare_dma",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "59305347807825107074764733493996428716",
"length": 1080.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-4476d10c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f11f4202caf5710204d334fe63392052783876d",
"target": {
"function": "sun6i_spi_prepare_dma",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "59305347807825107074764733493996428716",
"length": 1080.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-4d2f906e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd1ec7f9983b5cd3c77e0f7cda3fa8aed041af2f",
"target": {
"function": "sun6i_spi_transfer_one",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "207709486408377532894749455249672661797",
"length": 3513.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-591cd641"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36b29974a7ad2ff604c24ad348f940506c7b1209",
"target": {
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"131425933237577985826043062078141760344",
"31937360783432627704232461077535642395",
"41654525368589609571487329788743598370",
"256212457306931924223134651227298409653",
"35649822893637705601260010672057139871",
"75410629399528994050716823423194022238",
"106362331640649562110592855226670164000",
"8047676467015961546395010118105520306",
"56536952967079767737655938763948298659",
"277885480404280866639976885376006155328",
"169871460419910681489245931514895623441",
"106090937937039855689027136684619674479",
"188411384432928058755581943711544486647",
"270924413691395863862570566010045037921",
"71609298317569180696373184143336878796",
"125625963166130524806266155751643494001",
"157073668765223160273837698794892868730",
"319416312464095336058745798507832076532",
"94151159567872683008524083254595783790",
"178021005810485375643271412518959182388",
"244258666601527579462625340883661685680",
"315684594142265065737754382486992203604",
"218926164412793576252905662739054862042",
"8824642596359033041929743967909806366",
"31364127245495076710607035238484810268",
"221387399358062781315339517109735544016",
"6934823973418143191733515332229025840"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52517-5bb61e90"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36b29974a7ad2ff604c24ad348f940506c7b1209",
"target": {
"function": "sun6i_spi_transfer_one",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "207709486408377532894749455249672661797",
"length": 3513.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-65446212"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e149d524678431638ff378ef6025e4e89b71097",
"target": {
"function": "sun6i_spi_handler",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "332168751363223124574707812200851678296",
"length": 651.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-67b839bb"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36b29974a7ad2ff604c24ad348f940506c7b1209",
"target": {
"function": "sun6i_spi_probe",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "7246247381160976379455343873718746548",
"length": 3417.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-733292e2"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f11f4202caf5710204d334fe63392052783876d",
"target": {
"function": "sun6i_spi_probe",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "78639501323395879305674930366823655289",
"length": 3391.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-80cbed68"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36b29974a7ad2ff604c24ad348f940506c7b1209",
"target": {
"function": "sun6i_spi_handler",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "332168751363223124574707812200851678296",
"length": 651.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-8b35b4dd"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd1ec7f9983b5cd3c77e0f7cda3fa8aed041af2f",
"target": {
"function": "sun6i_spi_probe",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "7246247381160976379455343873718746548",
"length": 3417.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-9282ee8d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e149d524678431638ff378ef6025e4e89b71097",
"target": {
"function": "sun6i_spi_prepare_dma",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "59305347807825107074764733493996428716",
"length": 1080.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-96fa0039"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd1ec7f9983b5cd3c77e0f7cda3fa8aed041af2f",
"target": {
"function": "sun6i_spi_prepare_dma",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "59305347807825107074764733493996428716",
"length": 1080.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-b07cb4fd"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e149d524678431638ff378ef6025e4e89b71097",
"target": {
"function": "sun6i_spi_transfer_one",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "259537685452683536311784307682301912261",
"length": 4286.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-b0aabe30"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f11f4202caf5710204d334fe63392052783876d",
"target": {
"function": "sun6i_spi_transfer_one",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "28339490793142818775758289371022016257",
"length": 3951.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-c5f5f4f4"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e149d524678431638ff378ef6025e4e89b71097",
"target": {
"function": "sun6i_spi_probe",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "12366193841053010858126712477054349425",
"length": 3417.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-cdbdd3ea"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd1ec7f9983b5cd3c77e0f7cda3fa8aed041af2f",
"target": {
"function": "sun6i_spi_handler",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "332168751363223124574707812200851678296",
"length": 651.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-d2084d0c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f11f4202caf5710204d334fe63392052783876d",
"target": {
"function": "sun6i_spi_handler",
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"function_hash": "332168751363223124574707812200851678296",
"length": 651.0
},
"signature_type": "Function",
"id": "CVE-2023-52517-e22d56c1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e149d524678431638ff378ef6025e4e89b71097",
"target": {
"file": "drivers/spi/spi-sun6i.c"
},
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"131425933237577985826043062078141760344",
"31937360783432627704232461077535642395",
"41654525368589609571487329788743598370",
"256212457306931924223134651227298409653",
"35649822893637705601260010672057139871",
"75410629399528994050716823423194022238",
"106362331640649562110592855226670164000",
"8047676467015961546395010118105520306",
"56536952967079767737655938763948298659",
"277885480404280866639976885376006155328",
"169871460419910681489245931514895623441",
"106090937937039855689027136684619674479",
"188411384432928058755581943711544486647",
"270924413691395863862570566010045037921",
"71609298317569180696373184143336878796",
"123280156922784120154317241799613959502",
"157073668765223160273837698794892868730",
"319416312464095336058745798507832076532",
"94151159567872683008524083254595783790",
"178021005810485375643271412518959182388",
"244258666601527579462625340883661685680",
"315684594142265065737754382486992203604",
"218926164412793576252905662739054862042",
"8824642596359033041929743967909806366",
"31364127245495076710607035238484810268",
"221387399358062781315339517109735544016",
"6934823973418143191733515332229025840"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52517-e701d80d"
}
]