]> git.baikalelectronics.ru Git - kernel.git/commit
of: overlay: Fix memory leak in of_overlay_apply() error path
authorGeert Uytterhoeven <geert+renesas@glider.be>
Tue, 5 Dec 2017 15:27:02 +0000 (16:27 +0100)
committerRob Herring <robh@kernel.org>
Wed, 6 Dec 2017 22:04:36 +0000 (16:04 -0600)
commitfdfe317307ce256063e3f11859f1e11c0e6a9716
tree698e66155eb0e01ddf6acfa8cce1e7433db71dff
parent379c31bcdb69d8efe666f35f47ccb888b8deefa1
of: overlay: Fix memory leak in of_overlay_apply() error path

If of_resolve_phandles() fails, free_overlay_changeset() is called in
the error path.  However, that function returns early if the list hasn't
been initialized yet, before freeing the object.

Explicitly calling kfree() instead would solve that issue. However, that
complicates matter, by having to consider which of two different methods
to use to dispose of the same object.

Hence make free_overlay_changeset() consider initialization state of the
different parts of the object, making it always safe to call (once!) to
dispose of a (partially) initialized overlay_changeset:
  - Only destroy the changeset if the list was initialized,
  - Make init_overlay_changeset() store the ID in ovcs->id on success,
    to avoid calling idr_remove() with an error value or an already
    released ID.

Reported-by: Colin King <colin.king@canonical.com>
Fixes: f7e2aa3a465521c1 ("of: overlay: avoid race condition between applying multiple overlays")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Frank Rowand <frank.rowand@sony.com>
Signed-off-by: Rob Herring <robh@kernel.org>
drivers/of/overlay.c