Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9ec57818 authored by ruanjinjie's avatar ruanjinjie Committed by Greg Kroah-Hartman
Browse files

of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop() 



[ Upstream commit ee9d7a0e754568180a2f8ebc4aad226278a9116f ]

When kmalloc() fail to allocate memory in kasprintf(), fn_1 or fn_2 will
be NULL, and strcmp() will cause null pointer dereference.

Fixes: 2fe0e876 ("of: overlay: check prevents multiple fragments touching same property")
Signed-off-by: default avatarruanjinjie <ruanjinjie@huawei.com>
Link: https://lore.kernel.org/r/20221211023337.592266-1-ruanjinjie@huawei.com


Signed-off-by: default avatarRob Herring <robh@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent a44490ab

drivers/of/overlay.c

+2 −2
Original line number Diff line number Diff line
@@ -547,7 +547,7 @@ static int find_dup_cset_node_entry(struct overlay_changeset *ovcs, 


		fn_1 = kasprintf(GFP_KERNEL, "%pOF", ce_1->np);

		fn_2 = kasprintf(GFP_KERNEL, "%pOF", ce_2->np);

		node_path_match = !strcmp(fn_1, fn_2);

		node_path_match = !fn_1 || !fn_2 || !strcmp(fn_1, fn_2);

		kfree(fn_1);

		kfree(fn_2);

		if (node_path_match) {
@@ -582,7 +582,7 @@ static int find_dup_cset_prop(struct overlay_changeset *ovcs, 


		fn_1 = kasprintf(GFP_KERNEL, "%pOF", ce_1->np);

		fn_2 = kasprintf(GFP_KERNEL, "%pOF", ce_2->np);

		node_path_match = !strcmp(fn_1, fn_2);

		node_path_match = !fn_1 || !fn_2 || !strcmp(fn_1, fn_2);

		kfree(fn_1);

		kfree(fn_2);

		if (node_path_match &&