[PATCH v5 5/9] of/overlay: don't keep a negative id in ovcs->id on idr_alloc() failure

[Abdurrahman Hussain]

of_overlay_fdt_apply() stores the idr_alloc() return value in
ovcs->id before checking it. On failure the stored id is negative and
the error path runs free_overlay_changeset(), whose "if (ovcs->id)"
check passes: idr_remove() is called with a negative id and
list_del() runs on ovcs->ovcs_list, which is not initialized until
after the id allocation. An allocation failure at that point
dereferences NULL.

Reset ovcs->id to 0 before taking the error path.

Fixes: 61b4de4e0b38 ("of: overlay: minor restructuring")
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@xxxxxxxxxx>
---
 drivers/of/overlay.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 284c9bc6c9cf..f1aa8574069a 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -1038,6 +1038,8 @@ int of_overlay_fdt_apply(const void *overlay_fdt, u32 overlay_fdt_size,
 	ovcs->id = idr_alloc(&ovcs_idr, ovcs, 1, 0, GFP_KERNEL);
 	if (ovcs->id <= 0) {
 		ret = ovcs->id;
+		/* free_overlay_changeset() treats a set id as registered */
+		ovcs->id = 0;
 		goto err_free_ovcs;
 	}
 

-- 
2.54.0