diff options
| author | Abdurrahman Hussain <abdurrahman@nexthop.ai> | 2026-08-31 18:29:23 -0700 |
|---|---|---|
| committer | Rob Herring (Arm) <robh@kernel.org> | 2026-09-17 16:36:09 -0500 |
| commit | 44081d708b5b885487bac792db78324b7b4c267d (patch) | |
| tree | fe2bd0901e562699c9db0879a5ad9e526f47ae6e /tools/lib/python/kdoc/parse_data_structs.py | |
| parent | 814f2da6995772c07a7c9c2cc6028b6e3f3ecc9c (diff) | |
| download | linux-next-44081d708b5b885487bac792db78324b7b4c267d.tar.gz linux-next-44081d708b5b885487bac792db78324b7b4c267d.zip | |
of/overlay: only treat a positive changeset id as registered
of_overlay_fdt_apply() stores the idr_alloc() return value in
ovcs->id before checking it. On failure the stored id is negative,
free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove()
is called with a negative id and list_del() runs on ovcs->ovcs_list,
which is not initialized until after the id allocation. An allocation
failure at that point dereferences NULL.
Make free_overlay_changeset() treat only a strict-positive id as
registered. The rest of the function already copes with a
partially-initialized ovcs, so the error path stays a plain
goto err_free_ovcs.
Fixes: 61b4de4e0b38 ("of: overlay: minor restructuring")
Cc: stable@vger.kernel.org
Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Assisted-by: Claude:claude-fable-5 [Claude Code]
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Link: https://patch.msgid.link/20260831-nh-of-alias-overlay-v7-5-02754604805a@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc/parse_data_structs.py')
0 files changed, 0 insertions, 0 deletions