• Geert Uytterhoeven's avatar
    of: overlay: Fix memory leak in of_overlay_apply() error path · 1352f09b
    Geert Uytterhoeven authored
    If of_resolve_phandles() fails, free_overlay_changeset() is called in
    the error path.  However, that function returns early if the list hasn't
    been initialized yet, before freeing the object.
    
    Explicitly calling kfree() instead would solve that issue. However, that
    complicates matter, by having to consider which of two different methods
    to use to dispose of the same object.
    
    Hence make free_overlay_changeset() consider initialization state of the
    different parts of the object, making it always safe to call (once!) to
    dispose of a (partially) initialized overlay_changeset:
      - Only destroy the changeset if the list was initialized,
      - Make init_overlay_changeset() store the ID in ovcs->id on success,
        to avoid calling idr_remove() with an error value or an already
        released ID.
    Reported-by: default avatarColin King <colin.king@canonical.com>
    Fixes: f948d6d8 ("of: overlay: avoid race condition between applying multiple overlays")
    Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
    Reviewed-by: default avatarFrank Rowand <frank.rowand@sony.com>
    Signed-off-by: default avatarRob Herring <robh@kernel.org>
    1352f09b
overlay.c 25.4 KB