superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

of: dynamic: Fix use after free in of_changeset_add_prop_helper() 

If the of_changeset_add_property() function call fails, then this code
frees "new_pp" and then dereference it on the next line.  Return the
error code directly instead.

Fixes: c81f6ce167 ("of: dynamic: Fix memleak when of_pci_add_properties() failed")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/aKgljjhnpa4lVpdx@stanley.mountain
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
pull/1322/head
Dan Carpenter 2025-08-22 11:08:46 +03:00 committed by Rob Herring (Arm)
parent ac29e4487a
commit 80af3745ca
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/of/dynamic.c
View File

@ -935,13 +935,15 @@ static int of_changeset_add_prop_helper(struct of_changeset *ocs,
return -ENOMEM;
ret = of_changeset_add_property(ocs, np, new_pp);
if (ret)
if (ret) {
__of_prop_free(new_pp);
return ret;
}
new_pp->next = np->deadprops;
np->deadprops = new_pp;
return ret;
return 0;
}
/**