From: Daniel Okazaki <dtokazaki@google.com>
To: Bartosz Golaszewski <brgl@bgdev.pl>,
Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Daniel Okazaki <dtokazaki@google.com>,
kernel-team@android.com, linux-i2c@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH v3] eeprom: at24: fix memory corruption race condition
Date: Mon, 22 Apr 2024 17:43:36 +0000 [thread overview]
Message-ID: <20240422174337.2487142-1-dtokazaki@google.com> (raw)
If the eeprom is not accessible, an nvmem device will be registered, the
read will fail, and the device will be torn down. If another driver
accesses the nvmem device after the teardown, it will reference
invalid memory.
Move the failure point before registering the nvmem device.
Signed-off-by: Daniel Okazaki <dtokazaki@google.com>
Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label")
---
Changed sha length to 12 in description
---
drivers/misc/eeprom/at24.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 572333ead5fb..4bd4f32bcdab 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -758,15 +758,6 @@ static int at24_probe(struct i2c_client *client)
}
pm_runtime_enable(dev);
- at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
- if (IS_ERR(at24->nvmem)) {
- pm_runtime_disable(dev);
- if (!pm_runtime_status_suspended(dev))
- regulator_disable(at24->vcc_reg);
- return dev_err_probe(dev, PTR_ERR(at24->nvmem),
- "failed to register nvmem\n");
- }
-
/*
* Perform a one-byte test read to verify that the chip is functional,
* unless powering on the device is to be avoided during probe (i.e.
@@ -782,6 +773,15 @@ static int at24_probe(struct i2c_client *client)
}
}
+ at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
+ if (IS_ERR(at24->nvmem)) {
+ pm_runtime_disable(dev);
+ if (!pm_runtime_status_suspended(dev))
+ regulator_disable(at24->vcc_reg);
+ return dev_err_probe(dev, PTR_ERR(at24->nvmem),
+ "failed to register nvmem\n");
+ }
+
/* If this a SPD EEPROM, probe for DDR3 thermal sensor */
if (cdata == &at24_data_spd)
at24_probe_temp_sensor(client);
--
2.44.0.769.g3c40516874-goog
next reply other threads:[~2024-04-22 17:43 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-22 17:43 Daniel Okazaki [this message]
2024-04-22 22:09 ` [PATCH v3] eeprom: at24: fix memory corruption race condition Greg Kroah-Hartman
2024-04-23 8:14 ` Bartosz Golaszewski
2024-04-23 6:15 ` Markus Elfring
2024-04-23 8:13 ` Bartosz Golaszewski
2024-04-23 8:15 ` Bartosz Golaszewski
-- strict thread matches above, loose matches on Subject: below --
2024-04-19 19:04 [PATCH v2] " Markus Elfring
2024-04-19 19:12 ` [PATCH v3] " Daniel Okazaki
2024-04-20 6:15 ` Greg Kroah-Hartman
2024-04-20 9:11 ` Markus Elfring
2024-04-20 10:04 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240422174337.2487142-1-dtokazaki@google.com \
--to=dtokazaki@google.com \
--cc=arnd@arndb.de \
--cc=brgl@bgdev.pl \
--cc=gregkh@linuxfoundation.org \
--cc=kernel-team@android.com \
--cc=linux-i2c@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).