From nobody Fri Feb 13 19:29:08 2026 Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64D8D13C3F9 for ; Fri, 19 Apr 2024 19:12:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713553936; cv=none; b=VLMcUrxnMpHjOm82crpZ3Asjbe6zJPweTjY6Ejq91stb133dP03Gyha6GYgk0hWxc3XbckUDWiS5oB3PqLdZetnTPOcDZ9FguIQnpZfpJQ0Vnq9ZseeF9gAzE2K0iJ3tqrdHoS0ahfZp+ao7B1FPdk+N+4wNrUOu0QNDm4Jf40g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713553936; c=relaxed/simple; bh=0BdrZ3xw4Yg9KU1Jb5k96XvpBhEfUhYdRlzZJRoScYQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=JQUI1iiYtJbY0msReTh04L8/68ddQNaQsVtsYP+mQGNYjmzH4K/DjXa3pkxIaWIlaJJB7n/tnQMqfOtwelhNrtf8iN7MihUg6Nw91FNDO59WaTUFzk7Vx6Um4MfYZsPsBHCy0lLmvmDKUS/I4H3ibZObpXEVpSjqhRCAdneIMSo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--dtokazaki.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=WsY9X5WO; arc=none smtp.client-ip=209.85.219.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--dtokazaki.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="WsY9X5WO" Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-dc64f63d768so4430889276.2 for ; Fri, 19 Apr 2024 12:12:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1713553934; x=1714158734; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=S3nn0uxGKg2XiHfenj6FC27XZwwqUuZAKVQOuRIbTsY=; b=WsY9X5WOjLsKbNtGBbCKP9yo4UEXSzOcch7/yA1JuSXzZ50JjOp5SNiYemXfkMnh6F DDswJTf2fSYip6jwACsHWBTGvcoKF+tXhJO7Kyq2Yppszz6u0Igtnd3X/jeha4wQVLBU xRrWmJLPQyBdXV5cE+dh8qBnLmijS+5cz2UNIlnt6T3IAoCL5rBPLIg2+ZmoWJc65Mkq aRMTysgzXp9wtTbRITVhsPG3WRZbe+uQ/m0dr/s+Ig45qRJ0LxXOOBDkvqwKxn/bLonT ztFJizr50/GwkYP1B9OMkHqAEz6mGDl5QLSkKLcQ/Htn5z/zQXcrEjLjrKepuRO+WzWJ EaZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713553934; x=1714158734; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=S3nn0uxGKg2XiHfenj6FC27XZwwqUuZAKVQOuRIbTsY=; b=WaNG+nUDBReD3h2p9/iIE13wQsY38xB1plleBfZpoLI4mNrzqaeD0J1aA3HCZqh80a mG+zKMCNeN8czDgZtZ1aJrAzvXJ0pSSaxQmNcALcEelfFr8N0ccAJ9QZ90MwjnF91cbk ViJgvxwzaLJ5JqsbOvBlUJ4V3ExukLJU9e/x0bztcA95ImSTJwP3BnI6zhedwfbm+IXk 6hd/+vQReuQlVfo5F+wf9riVNDDUte6oKbtJ6iaZFU+Kw3+EZm55ViibXUwdTHkcTCTd 6MUHNrXZ7kv4t7mEI22S17kS8743SRcoFR0JvX+QbOhdT22RsFZhNPGR0eciDitEy9Em /14Q== X-Forwarded-Encrypted: i=1; AJvYcCXy8vOETwN7Um9YdAIvNUQ021r9kdOW+PAwY0X4vA1kYzj//24iS5rJ+M2pe+3lZ92vkYGL6QQep4jM6a/hEyTWCPGTljN4rfBaNWD1 X-Gm-Message-State: AOJu0YyanNIx2BU/Rty46mVIXx9yr+0o+/auYHDfDD0GB8a6H3g9K1PQ LzbIbFqqhJFxCn8tJ5Xa0YqxPdP5uDhF4lqtY7AEbNlyC4OlEkMdFdQjk0dCUvb7qifwV5HTLYG LqkrpLDLXQv6joQ== X-Google-Smtp-Source: AGHT+IHj6eljA4uiwvsWvXU1nqdzDaAjyxYm04dHEC2MitRGBMqDA0aouZ+8aEII49bUkpOJNBfyhLBrhL5qAeE= X-Received: from dtokazaki-pixel.c.googlers.com ([fda3:e722:ac3:cc00:20:ed76:c0a8:1a03]) (user=dtokazaki job=sendgmr) by 2002:a05:6902:709:b0:dcc:c57c:8873 with SMTP id k9-20020a056902070900b00dccc57c8873mr895580ybt.9.1713553934410; Fri, 19 Apr 2024 12:12:14 -0700 (PDT) Date: Fri, 19 Apr 2024 19:12:00 +0000 In-Reply-To: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.44.0.769.g3c40516874-goog Message-ID: <20240419191200.219548-1-dtokazaki@google.com> Subject: [PATCH v3] eeprom: at24: fix memory corruption race condition From: Daniel Okazaki To: Bartosz Golaszewski , Arnd Bergmann , Greg Kroah-Hartman Cc: Daniel Okazaki , kernel-team@android.com, linux-i2c@vger.kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") --- drivers/misc/eeprom/at24.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 572333ead5fb..4bd4f32bcdab 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -758,15 +758,6 @@ static int at24_probe(struct i2c_client *client) } pm_runtime_enable(dev); =20 - at24->nvmem =3D devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return dev_err_probe(dev, PTR_ERR(at24->nvmem), - "failed to register nvmem\n"); - } - /* * Perform a one-byte test read to verify that the chip is functional, * unless powering on the device is to be avoided during probe (i.e. @@ -782,6 +773,15 @@ static int at24_probe(struct i2c_client *client) } } =20 + at24->nvmem =3D devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return dev_err_probe(dev, PTR_ERR(at24->nvmem), + "failed to register nvmem\n"); + } + /* If this a SPD EEPROM, probe for DDR3 thermal sensor */ if (cdata =3D=3D &at24_data_spd) at24_probe_temp_sensor(client); --=20 2.44.0.769.g3c40516874-goog