eeprom: at24: fix memory corruption race condition

JIRA: https://issues.redhat.com/browse/RHEL-37020
CVE: CVE-2024-35848

commit f42c970
Author: Daniel Okazaki <dtokazaki@google.com>
Date: Mon, 22 Apr 2024 17:43:36 +0000

    If the eeprom is not accessible, an nvmem device will be registered, the
    read will fail, and the device will be torn down. If another driver
    accesses the nvmem device after the teardown, it will reference
    invalid memory.

    Move the failure point before registering the nvmem device.

    Signed-off-by: Daniel Okazaki <dtokazaki@google.com>
    Fixes: b20eb4c ("eeprom: at24: drop unnecessary label")
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

Signed-off-by: Mark Salter <msalter@redhat.com>

Author: mosalter

drivers/misc/eeprom/at24.c

@@ -781,15 +781,6 @@ static int at24_probe(struct i2c_client *client)
 	}
 	pm_runtime_enable(dev);
 
-	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
-	if (IS_ERR(at24->nvmem)) {
-		pm_runtime_disable(dev);
-		if (!pm_runtime_status_suspended(dev))
-			regulator_disable(at24->vcc_reg);
-		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
-				     "failed to register nvmem\n");
-	}
-
 	/*
 	 * Perform a one-byte test read to verify that the chip is functional,
 	 * unless powering on the device is to be avoided during probe (i.e.
@@ -805,6 +796,15 @@ static int at24_probe(struct i2c_client *client)
 		}
 	}
 
+	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
+	if (IS_ERR(at24->nvmem)) {
+		pm_runtime_disable(dev);
+		if (!pm_runtime_status_suspended(dev))
+			regulator_disable(at24->vcc_reg);
+		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
+				     "failed to register nvmem\n");
+	}
+
 	/* If this a SPD EEPROM, probe for DDR3 thermal sensor */
 	if (cdata == &at24_data_spd)
 		at24_probe_temp_sensor(client);