mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-02 07:04:24 +00:00
Code Issues Releases Wiki Activity

of: overlay: Fix memory leak in of_overlay_apply() error path

Browse source 
If of_resolve_phandles() fails, free_overlay_changeset() is called in
the error path.  However, that function returns early if the list hasn't
been initialized yet, before freeing the object.

Explicitly calling kfree() instead would solve that issue. However, that
complicates matter, by having to consider which of two different methods
to use to dispose of the same object.

Hence make free_overlay_changeset() consider initialization state of the
different parts of the object, making it always safe to call (once!) to
dispose of a (partially) initialized overlay_changeset:
  - Only destroy the changeset if the list was initialized,
  - Make init_overlay_changeset() store the ID in ovcs->id on success,
    to avoid calling idr_remove() with an error value or an already
    released ID.

Reported-by: Colin King <colin.king@canonical.com>
Fixes: f948d6d8b7 ("of: overlay: avoid race condition between applying multiple overlays")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Frank Rowand <frank.rowand@sony.com>
Signed-off-by: Rob Herring <robh@kernel.org>
This commit is contained in:
Geert Uytterhoeven 2017-12-05 16:27:02 +01:00 committed by Rob Herring
parent 3bcca2c271
commit 1352f09b4c
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/of/overlay.c
View file

@ -522,7 +522,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
struct device_node *node, *overlay_node;
struct fragment *fragment;
struct fragment *fragments;
int cnt, ret;
int cnt, id, ret;
/*
* Warn for some issues. Can not return -EINVAL for these until
@ -543,9 +543,9 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
of_changeset_init(&ovcs->cset);
ovcs->id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
if (ovcs->id <= 0)
return ovcs->id;
id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
if (id <= 0)
return id;
cnt = 0;
@ -611,6 +611,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
goto err_free_fragments;
}
ovcs->id = id;
ovcs->count = cnt;
ovcs->fragments = fragments;
@ -619,7 +620,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs,
err_free_fragments:
kfree(fragments);
err_free_idr:
idr_remove(&ovcs_idr, ovcs->id);
idr_remove(&ovcs_idr, id);
pr_err("%s() failed, ret = %d\n", __func__, ret);
@ -630,9 +631,8 @@ static void free_overlay_changeset(struct overlay_changeset *ovcs)
{
int i;
if (!ovcs->cset.entries.next)
return;
of_changeset_destroy(&ovcs->cset);
if (ovcs->cset.entries.next)
of_changeset_destroy(&ovcs->cset);
if (ovcs->id)
idr_remove(&ovcs_idr, ovcs->id);