diff options
| author | Abdurrahman Hussain <abdurrahman@nexthop.ai> | 2026-08-31 18:29:24 -0700 |
|---|---|---|
| committer | Rob Herring (Arm) <robh@kernel.org> | 2026-09-17 16:38:09 -0500 |
| commit | 1d62f0f2bc7edb12ed09f71203df0e47fa4efca4 (patch) | |
| tree | 44f568deb011eb880b5de9ec02e69146b493f685 /tools/lib/python/kdoc/python_version.py | |
| parent | 44081d708b5b885487bac792db78324b7b4c267d (diff) | |
| download | linux-next-1d62f0f2bc7edb12ed09f71203df0e47fa4efca4.tar.gz linux-next-1d62f0f2bc7edb12ed09f71203df0e47fa4efca4.zip | |
of/overlay: don't leak fragment references when changeset init fails
init_overlay_changeset() stores the number of initialized fragments
in ovcs->count only on full success. When find_target() or the
__symbols__ lookup fails partway through, the target and overlay
references taken for the fragments initialized so far are never
dropped: free_overlay_changeset() bounds its cleanup loop by
ovcs->count, which is still 0.
Store the running count on the error path so free_overlay_changeset()
puts whatever was set up. The store is guarded by ovcs->fragments
because on the allocation-failure path cnt still holds the counting
pass total while there is no fragments array; everywhere else cnt
only counts fully-initialized fragments.
Reported-by: Sashiko AI <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/20260805204009.CF3891F000E9@smtp.kernel.org
Fixes: 61b4de4e0b38 ("of: overlay: minor restructuring")
Assisted-by: Claude:claude-opus-4-8 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Link: https://patch.msgid.link/20260831-nh-of-alias-overlay-v7-6-02754604805a@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions