Re: [PATCH v6 06/10] of/overlay: only treat a positive changeset id as registered

[Geert Uytterhoeven]

On Wed, 5 Aug 2026 at 22:31, Abdurrahman Hussain <abdurrahman@xxxxxxxxxx> wrote:
> of_overlay_fdt_apply() stores the idr_alloc() return value in
> ovcs->id before checking it. On failure the stored id is negative,
> free_overlay_changeset()'s "if (ovcs->id)" check passes, idr_remove()
> is called with a negative id and list_del() runs on ovcs->ovcs_list,
> which is not initialized until after the id allocation. An allocation
> failure at that point dereferences NULL.
>
> Make free_overlay_changeset() treat only a strict-positive id as
> registered. The rest of the function already copes with a
> partially-initialized ovcs, so the error path stays a plain
> goto err_free_ovcs.
>
> Fixes: 61b4de4e0b38 ("of: overlay: minor restructuring")
> Cc: stable@xxxxxxxxxxxxxxx
> Suggested-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
> Assisted-by: Claude:claude-fable-5 [Claude Code]
> Signed-off-by: Abdurrahman Hussain <abdurrahman@xxxxxxxxxx>

Reviewed-by: Geert Uytterhoeven <geert+renesas@xxxxxxxxx>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds