2024-04-22 17:43:50

by Daniel Okazaki

[permalink] [raw]
Subject: [PATCH v3] eeprom: at24: fix memory corruption race condition

If the eeprom is not accessible, an nvmem device will be registered, the
read will fail, and the device will be torn down. If another driver
accesses the nvmem device after the teardown, it will reference
invalid memory.

Move the failure point before registering the nvmem device.

Signed-off-by: Daniel Okazaki <[email protected]>
Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label")
---
Changed sha length to 12 in description
---
drivers/misc/eeprom/at24.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 572333ead5fb..4bd4f32bcdab 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -758,15 +758,6 @@ static int at24_probe(struct i2c_client *client)
}
pm_runtime_enable(dev);

- at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
- if (IS_ERR(at24->nvmem)) {
- pm_runtime_disable(dev);
- if (!pm_runtime_status_suspended(dev))
- regulator_disable(at24->vcc_reg);
- return dev_err_probe(dev, PTR_ERR(at24->nvmem),
- "failed to register nvmem\n");
- }
-
/*
* Perform a one-byte test read to verify that the chip is functional,
* unless powering on the device is to be avoided during probe (i.e.
@@ -782,6 +773,15 @@ static int at24_probe(struct i2c_client *client)
}
}

+ at24->nvmem = devm_nvmem_register(dev, &nvmem_config);
+ if (IS_ERR(at24->nvmem)) {
+ pm_runtime_disable(dev);
+ if (!pm_runtime_status_suspended(dev))
+ regulator_disable(at24->vcc_reg);
+ return dev_err_probe(dev, PTR_ERR(at24->nvmem),
+ "failed to register nvmem\n");
+ }
+
/* If this a SPD EEPROM, probe for DDR3 thermal sensor */
if (cdata == &at24_data_spd)
at24_probe_temp_sensor(client);
--
2.44.0.769.g3c40516874-goog



2024-04-22 22:09:54

by Greg KH

[permalink] [raw]
Subject: Re: [PATCH v3] eeprom: at24: fix memory corruption race condition

On Mon, Apr 22, 2024 at 05:43:36PM +0000, Daniel Okazaki wrote:
> If the eeprom is not accessible, an nvmem device will be registered, the
> read will fail, and the device will be torn down. If another driver
> accesses the nvmem device after the teardown, it will reference
> invalid memory.
>
> Move the failure point before registering the nvmem device.
>
> Signed-off-by: Daniel Okazaki <[email protected]>
> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label")
> ---
> Changed sha length to 12 in description
> ---

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- You have marked a patch with a "Fixes:" tag for a commit that is in an
older released kernel, yet you do not have a cc: stable line in the
signed-off-by area at all, which means that the patch will not be
applied to any older kernel releases. To properly fix this, please
follow the documented rules in the
Documentation/process/stable-kernel-rules.rst file for how to resolve
this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

2024-04-23 06:16:26

by Markus Elfring

[permalink] [raw]
Subject: Re: [PATCH v3] eeprom: at24: fix memory corruption race condition

How do you think about to increase the version number for your attempt in the patch subject?

See also previous contribution:
https://lore.kernel.org/lkml/[email protected]/
https://lkml.org/lkml/2024/4/19/946


> If the eeprom is not accessible, an nvmem device will be registered, the
> read will fail, and the device will be torn down.


Please present the introduction for failure conditions as an enumeration.


> Move the failure point before registering the nvmem device.


I would interpret the diff data more in the way that a devm_nvmem_register() call
should be performed a bit later in the implementation of the function “at24_probe”.
How do you think about to mention the affected function also in the summary phrase?


> Changed sha length to 12 in description

A specification was adjusted for a tag.
Please add a version identifier here.
Will version descriptions be extended another bit?


> ---

I suggest to use blank line instead of a duplicate marker line.

Regards,
Markus

2024-04-23 08:14:35

by Bartosz Golaszewski

[permalink] [raw]
Subject: Re: [PATCH v3] eeprom: at24: fix memory corruption race condition

On Tue, Apr 23, 2024 at 12:09 AM Greg Kroah-Hartman
<[email protected]> wrote:
>
> On Mon, Apr 22, 2024 at 05:43:36PM +0000, Daniel Okazaki wrote:
> > If the eeprom is not accessible, an nvmem device will be registered, the
> > read will fail, and the device will be torn down. If another driver
> > accesses the nvmem device after the teardown, it will reference
> > invalid memory.
> >
> > Move the failure point before registering the nvmem device.
> >
> > Signed-off-by: Daniel Okazaki <[email protected]>
> > Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label")
> > ---
> > Changed sha length to 12 in description
> > ---
>
> Hi,
>
> This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
> a patch that has triggered this response. He used to manually respond
> to these common problems, but in order to save his sanity (he kept
> writing the same thing over and over, yet to different people), I was
> created. Hopefully you will not take offence and will fix the problem
> in your patch and resubmit it so that it can be accepted into the Linux
> kernel tree.
>
> You are receiving this message because of the following common error(s)
> as indicated below:
>
> - You have marked a patch with a "Fixes:" tag for a commit that is in an
> older released kernel, yet you do not have a cc: stable line in the
> signed-off-by area at all, which means that the patch will not be
> applied to any older kernel releases. To properly fix this, please
> follow the documented rules in the
> Documentation/process/stable-kernel-rules.rst file for how to resolve
> this.

I fixed it when applying.

Bart

>
> If you wish to discuss this problem further, or you have questions about
> how to resolve this issue, please feel free to respond to this email and
> Greg will reply once he has dug out from the pending patches received
> from other developers.
>
> thanks,
>
> greg k-h's patch email bot

2024-04-23 08:15:31

by Bartosz Golaszewski

[permalink] [raw]
Subject: Re: [PATCH v3] eeprom: at24: fix memory corruption race condition

From: Bartosz Golaszewski <[email protected]>


On Mon, 22 Apr 2024 17:43:36 +0000, Daniel Okazaki wrote:
> If the eeprom is not accessible, an nvmem device will be registered, the
> read will fail, and the device will be torn down. If another driver
> accesses the nvmem device after the teardown, it will reference
> invalid memory.
>
> Move the failure point before registering the nvmem device.
>
> [...]

Applied, thanks!

[1/1] eeprom: at24: fix memory corruption race condition
commit: f42c97027fb75776e2e9358d16bf4a99aeb04cf2

Best regards,
--
Bartosz Golaszewski <[email protected]>

2024-04-23 12:37:18

by Bartosz Golaszewski

[permalink] [raw]
Subject: Re: [PATCH v3] eeprom: at24: fix memory corruption race condition

On Mon, Apr 22, 2024 at 7:43 PM Daniel Okazaki <[email protected]> wrote:
>
> If the eeprom is not accessible, an nvmem device will be registered, the
> read will fail, and the device will be torn down. If another driver
> accesses the nvmem device after the teardown, it will reference
> invalid memory.
>
> Move the failure point before registering the nvmem device.
>
> Signed-off-by: Daniel Okazaki <[email protected]>
> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label")
> ---

I will take this patch because it does make sense but for the record:
this doesn't fully fix the issue with the nvmem race when tearing down
the device.

Bart