diff options
| author | Wandun Chen <chenwandun@lixiang.com> | 2026-06-04 09:53:32 +0800 |
|---|---|---|
| committer | Rob Herring (Arm) <robh@kernel.org> | 2026-06-04 14:41:22 -0500 |
| commit | e1686ca81dbf3edbde589b7daf312b45cbf76e03 (patch) | |
| tree | 94737bab8ea336caf1b4c838b0b67fcfb0b8313d /drivers/phy/eswin/git@git.tavy.me:linux.git | |
| parent | 0c1b852f13e207d642cef5c22002a91c8f07673e (diff) | |
of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
The global pointer 'reserved_mem' continues to reference the
reserved_mem_array which lives in __initdata if
alloc_reserved_mem_array() fails. of_reserved_mem_lookup() is
exported for post-init use, that would dereference freed memory
and trigger a use-after-free.
So reset reserved_mem_count to 0 when alloc_reserved_mem_array()
fails.
Fixes: 00c9a452a235 ("of: reserved_mem: Add code to dynamically allocate reserved_mem array")
Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
Link: https://patch.msgid.link/20260604015332.3669384-1-chenwandun1@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Diffstat (limited to 'drivers/phy/eswin/git@git.tavy.me:linux.git')
0 files changed, 0 insertions, 0 deletions