From: Karl Mehltretter <kmehltretter@gmail.com> mainline inclusion from mainline-v7.3-rc6 commit 26300879cd8e4612dce66bb8f6ff7cd35fcf3e59 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20479 CVE: CVE-2026-98834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd_otp_nvmem_add() unregisters the user device but leaves mtd->otp_user_nvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again. Clear mtd->otp_user_nvmem after unregistering it. Fixes: e0489f6e221f ("mtd: core: fix error path for nvmem provider") Fixes: fe0b8213c012 ("mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Conflicts: drivers/mtd/mtdcore.c [Context lines differ due to code layout differences between OLK-6.6 and mainline; commit fe0b8213c012 ("mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported") is not backported, so the err label has no EOPNOTSUPP handling; the assignment was inserted right after nvmem_unregister() in the existing err path] Signed-off-by: Lu Jialin <lujialin4@huawei.com> --- drivers/mtd/mtdcore.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c index 28aa823e90ab..7f180d934aa8 100644 --- a/drivers/mtd/mtdcore.c +++ b/drivers/mtd/mtdcore.c @@ -1014,6 +1014,7 @@ static int mtd_otp_nvmem_add(struct mtd_info *mtd) err: nvmem_unregister(mtd->otp_user_nvmem); + mtd->otp_user_nvmem = NULL; return dev_err_probe(dev, err, "Failed to register OTP NVMEM device\n"); } -- 2.34.1