diff options
| author | Wandun Chen <chenwandun@lixiang.com> | 2026-06-04 04:53:32 +0300 |
|---|---|---|
| committer | Rob Herring (Arm) <robh@kernel.org> | 2026-06-04 22:41:22 +0300 |
| commit | e1686ca81dbf3edbde589b7daf312b45cbf76e03 (patch) | |
| tree | 94737bab8ea336caf1b4c838b0b67fcfb0b8313d /scripts/diffconfig | |
| parent | 0c1b852f13e207d642cef5c22002a91c8f07673e (diff) | |
| download | linux-e1686ca81dbf3edbde589b7daf312b45cbf76e03.tar.xz | |
of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails
The global pointer 'reserved_mem' continues to reference the
reserved_mem_array which lives in __initdata if
alloc_reserved_mem_array() fails. of_reserved_mem_lookup() is
exported for post-init use, that would dereference freed memory
and trigger a use-after-free.
So reset reserved_mem_count to 0 when alloc_reserved_mem_array()
fails.
Fixes: 00c9a452a235 ("of: reserved_mem: Add code to dynamically allocate reserved_mem array")
Signed-off-by: Wandun Chen <chenwandun@lixiang.com>
Link: https://patch.msgid.link/20260604015332.3669384-1-chenwandun1@gmail.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Diffstat (limited to 'scripts/diffconfig')
0 files changed, 0 insertions, 0 deletions