Patch "eeprom: at24: fix memory corruption race condition" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    eeprom: at24: fix memory corruption race condition

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     eeprom-at24-fix-memory-corruption-race-condition.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5f9b97135ca6879632ad25851b47d46f9b3eb743
Author: Daniel Okazaki <dtokazaki@xxxxxxxxxx>
Date:   Mon Apr 22 17:43:36 2024 +0000

    eeprom: at24: fix memory corruption race condition
    
    [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ]
    
    If the eeprom is not accessible, an nvmem device will be registered, the
    read will fail, and the device will be torn down. If another driver
    accesses the nvmem device after the teardown, it will reference
    invalid memory.
    
    Move the failure point before registering the nvmem device.
    
    Signed-off-by: Daniel Okazaki <dtokazaki@xxxxxxxxxx>
    Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label")
    Cc: stable@xxxxxxxxxxxxxxx
    Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@xxxxxxxxxx
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index dc30fe137b40f..e664c1c852503 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -781,15 +781,6 @@ static int at24_probe(struct i2c_client *client)
 	}
 	pm_runtime_enable(dev);
 
-	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
-	if (IS_ERR(at24->nvmem)) {
-		pm_runtime_disable(dev);
-		if (!pm_runtime_status_suspended(dev))
-			regulator_disable(at24->vcc_reg);
-		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
-				     "failed to register nvmem\n");
-	}
-
 	/*
 	 * Perform a one-byte test read to verify that the chip is functional,
 	 * unless powering on the device is to be avoided during probe (i.e.
@@ -805,6 +796,15 @@ static int at24_probe(struct i2c_client *client)
 		}
 	}
 
+	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
+	if (IS_ERR(at24->nvmem)) {
+		pm_runtime_disable(dev);
+		if (!pm_runtime_status_suspended(dev))
+			regulator_disable(at24->vcc_reg);
+		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
+				     "failed to register nvmem\n");
+	}
+
 	/* If this a SPD EEPROM, probe for DDR3 thermal sensor */
 	if (cdata == &at24_data_spd)
 		at24_probe_temp_sensor(client);