* [PATCH next] of: dynamic: Fix use after free in of_changeset_add_prop_helper()
@ 2025-08-22 8:08 Dan Carpenter
2025-08-22 20:42 ` Rob Herring (Arm)
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2025-08-22 8:08 UTC (permalink / raw)
To: Lizhi Hou
Cc: Rob Herring, Saravana Kannan, devicetree, linux-kernel,
kernel-janitors
If the of_changeset_add_property() function call fails, then this code
frees "new_pp" and then dereference it on the next line. Return the
error code directly instead.
Fixes: c81f6ce16785 ("of: dynamic: Fix memleak when of_pci_add_properties() failed")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/of/dynamic.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index dd30b7d8b5e4..2eaaddcb0ec4 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -935,13 +935,15 @@ static int of_changeset_add_prop_helper(struct of_changeset *ocs,
return -ENOMEM;
ret = of_changeset_add_property(ocs, np, new_pp);
- if (ret)
+ if (ret) {
__of_prop_free(new_pp);
+ return ret;
+ }
new_pp->next = np->deadprops;
np->deadprops = new_pp;
- return ret;
+ return 0;
}
/**
--
2.47.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH next] of: dynamic: Fix use after free in of_changeset_add_prop_helper()
2025-08-22 8:08 [PATCH next] of: dynamic: Fix use after free in of_changeset_add_prop_helper() Dan Carpenter
@ 2025-08-22 20:42 ` Rob Herring (Arm)
0 siblings, 0 replies; 2+ messages in thread
From: Rob Herring (Arm) @ 2025-08-22 20:42 UTC (permalink / raw)
To: Dan Carpenter
Cc: devicetree, Saravana Kannan, Lizhi Hou, kernel-janitors,
linux-kernel
On Fri, 22 Aug 2025 11:08:46 +0300, Dan Carpenter wrote:
> If the of_changeset_add_property() function call fails, then this code
> frees "new_pp" and then dereference it on the next line. Return the
> error code directly instead.
>
> Fixes: c81f6ce16785 ("of: dynamic: Fix memleak when of_pci_add_properties() failed")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/of/dynamic.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
Applied, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-08-22 20:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-22 8:08 [PATCH next] of: dynamic: Fix use after free in of_changeset_add_prop_helper() Dan Carpenter
2025-08-22 20:42 ` Rob Herring (Arm)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).