CVE-2024-26807: spi: cadence-qspi: fix pointer reference in runtime PM hooks

In the Linux kernel, the following vulnerability has been resolved:

Both cadence-quadspi ->runtimesuspend() and ->runtimeresume() implementations start with:

struct cqspist cqspi = devgetdrvdata(dev); struct spicontroller host = devgetdrvdata(dev);

This obviously cannot be correct, unless "struct cqspist" is the first member of " struct spicontroller", or the other way around, but it is not the case. "struct spicontroller" is allocated by devmspiallochost(), which allocates an extra amount of memory for private data, used to store "struct cqspist".

The ->probe() function of the cadence-quadspi driver then sets the device drvdata to store the address of the "struct cqspist" structure. Therefore:

struct cqspist cqspi = devgetdrvdata(dev);

is correct, but:

struct spicontroller host = devgetdrvdata(dev);

is not, as it makes "host" point not to a "struct spicontroller" but to the same "struct cqspist" structure as above.

This obviously leads to bad things (memory corruption, kernel crashes) directly during ->probe(), as ->probe() enables the device using PM runtime, leading the ->runtimeresume() hook being called, which in turns calls spicontrollerresume() with the wrong pointer.

This has at least been reported [0] to cause a kernel crash, but the exact behavior will depend on the memory contents.

[0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/

This issue potentially affects all platforms that are currently using the cadence-quadspi driver.