<feed xmlns='http://www.w3.org/2005/Atom'>
<title>kernel/linux.git/drivers/of/overlay.c, branch v6.6.131</title>
<subtitle>Linux kernel stable tree (mirror)</subtitle>
<id>https://git.radix-linux.su/kernel/linux.git/atom?h=v6.6.131</id>
<link rel='self' href='https://git.radix-linux.su/kernel/linux.git/atom?h=v6.6.131'/>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/'/>
<updated>2025-09-04T13:30:18+00:00</updated>
<entry>
<title>of: Add a helper to free property struct</title>
<updated>2025-09-04T13:30:18+00:00</updated>
<author>
<name>Rob Herring</name>
<email>robh@kernel.org</email>
</author>
<published>2024-04-09T18:59:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=749137b41e7064ee8b8b1f04a5a27478226d09fc'/>
<id>urn:sha1:749137b41e7064ee8b8b1f04a5a27478226d09fc</id>
<content type='text'>
[ Upstream commit 1c5e3d9bf33b811e1c6dd9081b322004acc4a1fd ]

Freeing a property struct is 3 kfree()'s which is duplicated in multiple
spots. Add a helper, __of_prop_free(), and replace all the open coded
cases in the DT code.

Reviewed-by: Saravana Kannan &lt;saravanak@google.com&gt;
Reviewed-by: Jonathan Cameron &lt;Jonathan.Cameron@huawei.com&gt;
Link: https://lore.kernel.org/r/20240409-dt-cleanup-free-v2-1-5b419a4af38d@kernel.org
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
Stable-dep-of: 80af3745ca46 ("of: dynamic: Fix use after free in of_changeset_add_prop_helper()")
Signed-off-by: Sasha Levin &lt;sashal@kernel.org&gt;
</content>
</entry>
<entry>
<title>of: overlay: Reorder struct fragment fields kerneldoc</title>
<updated>2023-10-02T16:34:23+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert+renesas@glider.be</email>
</author>
<published>2023-09-28T09:35:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=5d007ffdf6025fe83e497c44ed7c8aa8f150c4d1'/>
<id>urn:sha1:5d007ffdf6025fe83e497c44ed7c8aa8f150c4d1</id>
<content type='text'>
The fields of the fragment structure were reordered, but the kerneldoc
was not updated.

Fixes: 81225ea682f45629 ("of: overlay: reorder fields in struct fragment")
Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Link: https://lore.kernel.org/r/cfa36d2bb95e3c399c415dbf58057302c70ef375.1695893695.git.geert+renesas@glider.be
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
</content>
</entry>
<entry>
<title>of: overlay: Call of_changeset_init() early</title>
<updated>2023-08-24T01:04:17+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert+renesas@glider.be</email>
</author>
<published>2023-07-28T08:50:28+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=a9515ff4fb142b690a0d2b58782b15903b990dba'/>
<id>urn:sha1:a9515ff4fb142b690a0d2b58782b15903b990dba</id>
<content type='text'>
When of_overlay_fdt_apply() fails, the changeset may be partially
applied, and the caller is still expected to call of_overlay_remove() to
clean up this partial state.

However, of_overlay_apply() calls of_resolve_phandles() before
init_overlay_changeset().  Hence if the overlay fails to apply due to an
unresolved symbol, the overlay_changeset.cset.entries list is still
uninitialized, and cleanup will crash with a NULL-pointer dereference in
overlay_removal_is_ok().

Fix this by moving the call to of_changeset_init() from
init_overlay_changeset() to of_overlay_fdt_apply(), where all other
early initialization is done.

Fixes: f948d6d8b792bb90 ("of: overlay: avoid race condition between applying multiple overlays")
Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Link: https://lore.kernel.org/r/4f1d6d74b61cba2599026adb6d1948ae559ce91f.1690533838.git.geert+renesas@glider.be
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
</content>
</entry>
<entry>
<title>of: overlay: Extend of_overlay_fdt_apply() to specify the target node</title>
<updated>2023-08-22T19:56:10+00:00</updated>
<author>
<name>Lizhi Hou</name>
<email>lizhi.hou@amd.com</email>
</author>
<published>2023-08-15T17:19:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=47284862bfc7fd5672e731e827f43f26bdbd155c'/>
<id>urn:sha1:47284862bfc7fd5672e731e827f43f26bdbd155c</id>
<content type='text'>
Currently, in an overlay fdt fragment, it needs to specify the exact
location in base DT. In another word, when the fdt fragment is generated,
the base DT location for the fragment is already known.

There is new use case that the base DT location is unknown when fdt
fragment is generated. For example, the add-on device provide a fdt
overlay with its firmware to describe its downstream devices. Because it
is add-on device which can be plugged to different systems, its firmware
will not be able to know the overlay location in base DT. Instead, the
device driver will load the overlay fdt and apply it to base DT at runtime.
In this case, of_overlay_fdt_apply() needs to be extended to specify
the target node for device driver to apply overlay fdt.
    int overlay_fdt_apply(..., struct device_node *base);

Signed-off-by: Lizhi Hou &lt;lizhi.hou@amd.com&gt;
Link: https://lore.kernel.org/r/1692120000-46900-5-git-send-email-lizhi.hou@amd.com
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
</content>
</entry>
<entry>
<title>of: overlay: Fix missing of_node_put() in error case of init_overlay_changeset()</title>
<updated>2023-06-09T22:12:37+00:00</updated>
<author>
<name>Kunihiko Hayashi</name>
<email>hayashi.kunihiko@socionext.com</email>
</author>
<published>2023-06-02T02:05:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=39affd1fdf65983904fafc07cf607cff737eaf30'/>
<id>urn:sha1:39affd1fdf65983904fafc07cf607cff737eaf30</id>
<content type='text'>
In init_overlay_changeset(), the variable "node" is from
of_get_child_by_name(), and the "node" should be discarded in error case.

Fixes: d1651b03c2df ("of: overlay: add overlay symbols to live device tree")
Signed-off-by: Kunihiko Hayashi &lt;hayashi.kunihiko@socionext.com&gt;
Link: https://lore.kernel.org/r/20230602020502.11693-1-hayashi.kunihiko@socionext.com
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
</content>
</entry>
<entry>
<title>of: overlay: Fix trivial typo</title>
<updated>2022-12-26T22:09:29+00:00</updated>
<author>
<name>Ricardo Ribalda</name>
<email>ribalda@chromium.org</email>
</author>
<published>2022-12-20T22:20:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=8e5d0c68f23ab139e472f93ebbcfda9545e9953b'/>
<id>urn:sha1:8e5d0c68f23ab139e472f93ebbcfda9545e9953b</id>
<content type='text'>
Permitted is spelled with two t.

Signed-off-by: Ricardo Ribalda &lt;ribalda@chromium.org&gt;
Reviewed-by: Philippe Mathieu-Daudé &lt;philmd@linaro.org&gt;
Link: https://lore.kernel.org/r/20221220-permited-v1-3-52ea9857fa61@chromium.org
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
</content>
</entry>
<entry>
<title>of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()</title>
<updated>2022-12-12T01:00:36+00:00</updated>
<author>
<name>ruanjinjie</name>
<email>ruanjinjie@huawei.com</email>
</author>
<published>2022-12-11T02:33:37+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=ee9d7a0e754568180a2f8ebc4aad226278a9116f'/>
<id>urn:sha1:ee9d7a0e754568180a2f8ebc4aad226278a9116f</id>
<content type='text'>
When kmalloc() fail to allocate memory in kasprintf(), fn_1 or fn_2 will
be NULL, and strcmp() will cause null pointer dereference.

Fixes: 2fe0e8769df9 ("of: overlay: check prevents multiple fragments touching same property")
Signed-off-by: ruanjinjie &lt;ruanjinjie@huawei.com&gt;
Link: https://lore.kernel.org/r/20221211023337.592266-1-ruanjinjie@huawei.com
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
</content>
</entry>
<entry>
<title>of: overlay: Simplify of_overlay_fdt_apply() tail</title>
<updated>2022-07-19T21:56:48+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert+renesas@glider.be</email>
</author>
<published>2022-07-15T14:03:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=e76f4a6107ebe4af5405bb1b94d0e717a40fd306'/>
<id>urn:sha1:e76f4a6107ebe4af5405bb1b94d0e717a40fd306</id>
<content type='text'>
It does not hurt to fill in the changeset id while the mutex is still
held.  After doing so, the function tails for the success and failure
cases become identical, so they can be unified.

Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Reviewed-by: Frank Rowand &lt;frank.rowand@sony.com&gt;
Tested-by: Frank Rowand &lt;frank.rowand@sony.com&gt;
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
Link: https://lore.kernel.org/r/6a3357a8f7f29704350e3ffae768ee8a462b54d3.1657893306.git.geert+renesas@glider.be
</content>
</entry>
<entry>
<title>of: overlay: Move devicetree_corrupt() check up</title>
<updated>2022-07-19T21:56:48+00:00</updated>
<author>
<name>Geert Uytterhoeven</name>
<email>geert+renesas@glider.be</email>
</author>
<published>2022-07-15T14:03:14+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=e385b0ba6a137f34953e746d70d543660c2de1a0'/>
<id>urn:sha1:e385b0ba6a137f34953e746d70d543660c2de1a0</id>
<content type='text'>
There is no point in doing several preparatory steps in
of_overlay_fdt_apply(), only to see of_overlay_apply() return early
because of a corrupt device tree.

Move the check for a corrupt device tree from of_overlay_apply() to
of_overlay_fdt_apply(), to check for this as early as possible.

Signed-off-by: Geert Uytterhoeven &lt;geert+renesas@glider.be&gt;
Reviewed-by: Frank Rowand &lt;frank.rowand@sony.com&gt;
Tested-by: Frank Rowand &lt;frank.rowand@sony.com&gt;
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
Link: https://lore.kernel.org/r/c91ce7112eb5167ea46a43d8a980e76b920010ba.1657893306.git.geert+renesas@glider.be
</content>
</entry>
<entry>
<title>of: overlay: do not free changeset when of_overlay_apply returns error</title>
<updated>2022-05-03T16:53:15+00:00</updated>
<author>
<name>Frank Rowand</name>
<email>frank.rowand@sony.com</email>
</author>
<published>2022-05-02T18:17:42+00:00</published>
<link rel='alternate' type='text/html' href='https://git.radix-linux.su/kernel/linux.git/commit/?id=421f4d14bc037f708a3d11fbb01274b741767bf9'/>
<id>urn:sha1:421f4d14bc037f708a3d11fbb01274b741767bf9</id>
<content type='text'>
New unittests for overlay notifiers reveal a memory leak in
of_overlay_apply() when a notifier returns an error for action
OF_OVERLAY_POST_APPLY.  The pr_err() message is:

   OF: ERROR: memory leak, expected refcount 1 instead of 3,
   of_node_get()/of_node_put() unbalanced - destroy cset entry: attach
   overlay node /testcase-data/overlay-node/test-bus/test-unittest17

Change the error path to no longer call free_overlay_changeset(),
and document that the caller of of_overlay_fdt_apply() may choose
to remove the overlay.

Update the unittest that triggered the error to expect the changed
return values and to call of_overlay_remove().

Signed-off-by: Frank Rowand &lt;frank.rowand@sony.com&gt;
Signed-off-by: Rob Herring &lt;robh@kernel.org&gt;
Link: https://lore.kernel.org/r/20220502181742.1402826-4-frowand.list@gmail.com
</content>
</entry>
</feed>
