diff mbox series

[SRU,F,1/3] misc: eeprom: at24: fix regulator underflow

Message ID 20240909011040.355032-2-hui.wang@canonical.com
State New
Headers show
Series CVE-2024-35848 | expand

Commit Message

Hui Wang Sept. 9, 2024, 1:10 a.m. UTC 
From: Michael Auchter <michael.auchter@ni.com>

The at24 driver attempts to read a byte from the device to validate that
it's actually present, and if not, disables the vcc regulator and
returns -ENODEV. However, between the read and the error handling path,
pm_runtime_idle() is called and invokes the driver's suspend callback,
which also disables the vcc regulator. This leads to an underflow of the
regulator enable count if the EEPROM is not present.

Move the pm_runtime_suspend() call to be after the error handling path
to resolve this.

Fixes: cd5676db0574 ("misc: eeprom: at24: support pm_runtime control")
Signed-off-by: Michael Auchter <michael.auchter@ni.com>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
(backported from commit 58d6fee50e67bb1c69977f1a534ccb17bf58b0f1)
[hui: To fix this CVE issue, we need to backport the commit
f42c97027fb7 and the commit needs the pm_runtime_idle() to be moved
behind the error checking. Here adjust the context due to missing the
commit 285be87c79e1 ("eeprom: at24: Improve confusing log message")]
CVE-2024-35848
Signed-off-by: Hui Wang <hui.wang@canonical.com>
---
 drivers/misc/eeprom/at24.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 2cccd82a3106..b1c17a058215 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -710,12 +710,13 @@  static int at24_probe(struct i2c_client *client)
 	 * chip is functional.
 	 */
 	err = at24_read(at24, 0, &test_byte, 1);
-	pm_runtime_idle(dev);
 	if (err) {
 		pm_runtime_disable(dev);
 		return -ENODEV;
 	}
 
+	pm_runtime_idle(dev);
+
 	dev_info(dev, "%u byte %s EEPROM, %s, %u bytes/write\n",
 		 byte_len, client->name,
 		 writable ? "writable" : "read-only", at24->write_max);