Patch "eeprom: at24: fix memory corruption race condition" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    eeprom: at24: fix memory corruption race condition

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     eeprom-at24-fix-memory-corruption-race-condition.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e4f25a89a176e481e32afb2f3f035128b210058b
Author: Daniel Okazaki <dtokazaki@xxxxxxxxxx>
Date:   Mon Apr 22 17:43:36 2024 +0000

    eeprom: at24: fix memory corruption race condition
    
    [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ]
    
    If the eeprom is not accessible, an nvmem device will be registered, the
    read will fail, and the device will be torn down. If another driver
    accesses the nvmem device after the teardown, it will reference
    invalid memory.
    
    Move the failure point before registering the nvmem device.
    
    Signed-off-by: Daniel Okazaki <dtokazaki@xxxxxxxxxx>
    Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label")
    Cc: stable@xxxxxxxxxxxxxxx
    Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@xxxxxxxxxx
    Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 65a7517c031a7..02bea44369435 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -782,15 +782,6 @@ static int at24_probe(struct i2c_client *client)
 	pm_runtime_set_active(dev);
 	pm_runtime_enable(dev);
 
-	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
-	if (IS_ERR(at24->nvmem)) {
-		pm_runtime_disable(dev);
-		if (!pm_runtime_status_suspended(dev))
-			regulator_disable(at24->vcc_reg);
-		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
-				     "failed to register nvmem\n");
-	}
-
 	/*
 	 * Perform a one-byte test read to verify that the
 	 * chip is functional.
@@ -803,6 +794,15 @@ static int at24_probe(struct i2c_client *client)
 		return -ENODEV;
 	}
 
+	at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
+	if (IS_ERR(at24->nvmem)) {
+		pm_runtime_disable(dev);
+		if (!pm_runtime_status_suspended(dev))
+			regulator_disable(at24->vcc_reg);
+		return dev_err_probe(dev, PTR_ERR(at24->nvmem),
+				     "failed to register nvmem\n");
+	}
+
 	/* If this a SPD EEPROM, probe for DDR3 thermal sensor */
 	if (cdata == &at24_data_spd)
 		at24_probe_temp_sensor(client);