From: Zilin Guan <zilin@seu.edu.cn> stable inclusion from stable-v6.18.6 commit f09b0f705bd7197863b90256ef533a6414d1db2c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13687 CVE: CVE-2026-23137 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b ] In unittest_data_add(), if of_resolve_phandles() fails, the allocated unittest_data is not freed, leading to a memory leak. Fix this by using scope-based cleanup helper __free(kfree) for automatic resource cleanup. This ensures unittest_data is automatically freed when it goes out of scope in error paths. For the success path, use retain_and_null_ptr() to transfer ownership of the memory to the device tree and prevent double freeing. Fixes: 2eb46da2a760 ("of/selftest: Use the resolver to fixup phandles") Suggested-by: Rob Herring <robh@kernel.org> Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn> Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn> Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Link: https://patch.msgid.link/20251231114915.234638-1-zilin@seu.edu.cn Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: drivers/of/unittest.c [092d00ead733 ("cleanup: Provide retain_and_null_ptr()") was not merged] Signed-off-by: Lin Ruifeng <linruifeng4@huawei.com> --- drivers/of/unittest.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c index 5bfec440b4fd..4824dd78e0fd 100644 --- a/drivers/of/unittest.c +++ b/drivers/of/unittest.c @@ -1680,6 +1680,7 @@ static int __init unittest_data_add(void) rc = of_resolve_phandles(unittest_data_node); if (rc) { pr_err("%s: Failed to resolve phandles (rc=%i)\n", __func__, rc); + kfree(unittest_data); of_overlay_mutex_unlock(); return -EINVAL; } -- 2.43.0