From patchwork Mon Sep 9 01:10:38 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hui Wang X-Patchwork-Id: 1982251 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4X280x6WHCz1y1q for ; Mon, 9 Sep 2024 11:11:13 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1snSvg-0004qp-Cl; Mon, 09 Sep 2024 01:10:56 +0000 Received: from smtp-relay-canonical-1.internal ([10.131.114.174] helo=smtp-relay-canonical-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1snSve-0004qg-W2 for kernel-team@lists.ubuntu.com; Mon, 09 Sep 2024 01:10:55 +0000 Received: from hwang4-ThinkPad-T14s-Gen-2a.. (unknown [120.85.105.240]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id A22403F3A5 for ; Mon, 9 Sep 2024 01:10:51 +0000 (UTC) From: Hui Wang To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH 1/3] misc: eeprom: at24: fix regulator underflow Date: Mon, 9 Sep 2024 09:10:38 +0800 Message-Id: <20240909011040.355032-2-hui.wang@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240909011040.355032-1-hui.wang@canonical.com> References: <20240909011040.355032-1-hui.wang@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Michael Auchter The at24 driver attempts to read a byte from the device to validate that it's actually present, and if not, disables the vcc regulator and returns -ENODEV. However, between the read and the error handling path, pm_runtime_idle() is called and invokes the driver's suspend callback, which also disables the vcc regulator. This leads to an underflow of the regulator enable count if the EEPROM is not present. Move the pm_runtime_suspend() call to be after the error handling path to resolve this. Fixes: cd5676db0574 ("misc: eeprom: at24: support pm_runtime control") Signed-off-by: Michael Auchter Signed-off-by: Bartosz Golaszewski (backported from commit 58d6fee50e67bb1c69977f1a534ccb17bf58b0f1) [hui: To fix this CVE issue, we need to backport the commit f42c97027fb7 and the commit needs the pm_runtime_idle() to be moved behind the error checking. Here adjust the context due to missing the commit 285be87c79e1 ("eeprom: at24: Improve confusing log message")] CVE-2024-35848 Signed-off-by: Hui Wang --- drivers/misc/eeprom/at24.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 2cccd82a3106..b1c17a058215 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -710,12 +710,13 @@ static int at24_probe(struct i2c_client *client) * chip is functional. */ err = at24_read(at24, 0, &test_byte, 1); - pm_runtime_idle(dev); if (err) { pm_runtime_disable(dev); return -ENODEV; } + pm_runtime_idle(dev); + dev_info(dev, "%u byte %s EEPROM, %s, %u bytes/write\n", byte_len, client->name, writable ? "writable" : "read-only", at24->write_max);