CVE-2022-48723

What it actually does

Reference count leak on dma_rx and dma_tx DMA channel objects occurs in uniphier_spi_probe() when dma_get_slave_caps() or devm_spi_register_master() fails, preventing proper decrement of their refcounts.

Why it matters to the business

Kernel memory or DMA resource exhaustion can occur on systems using the UniPhier SPI controller after repeated failed probe attempts, potentially leading to degraded performance or instability in affected embedded Linux devices.

How an attack unfolds

An attacker with local access triggers repeated load/unload or error conditions in the uniphier SPI driver probe path to accumulate unreleased DMA channel references, gradually consuming kernel resources until exhaustion.

How to fix it

Update the Linux kernel to the fixed commit e895e067d73e154b1ebc84a124e00831e311d9b0 or later stable release containing the reference count decrement in the error paths of uniphier_spi_probe().

How to confirm the fix worked

Verify the presence of the fix by inspecting the uniphier_spi_probe() function for refcount decrements on dma_rx and dma_tx in all error return paths after the DMA capability and master registration calls.

Typical attack path

1. Obtain local access or ability to trigger SPI device probe failures
2. Cause dma_get_slave_caps() or devm_spi_register_master() to return errors repeatedly
3. Accumulate unreleased references to dma_rx and dma_tx objects
4. Drive system toward DMA or memory resource exhaustion

How to detect it

Review kernel logs for repeated uniphier_spi_probe error returns from dma_get_slave_caps or devm_spi_register_master without corresponding cleanup messages; inspect for increasing DMA channel reference counts via kernel memory debugging tools.

• uniphier_spi_probe
• dma_get_slave_caps
• devm_spi_register_master

What your security team should do

• Apply the kernel patch or upgrade to a fixed version immediately on all systems using the UniPhier SPI driver
• Monitor for repeated SPI probe failures in kernel logs as an indicator of potential resource pressure
• Limit local access and unprivileged module loading where possible until patched