Re: [PATCH] of/overlay: don't pass the changeset's own id to of_overlay_remove()

[Rob Herring <robh@kernel.org>]

On Thu, Sep 17, 2026 at 07:28:16PM -0700, Abdurrahman Hussain wrote:
> of_overlay_remove_all() passes &ovcs->id to of_overlay_remove(), which
> zeroes *ovcs_id once the changeset is reverted, before calling
> free_overlay_changeset(). Through the aliased pointer that zeroes
> ovcs->id itself, so free_overlay_changeset()'s "ovcs->id > 0" guard
> is false and both idr_remove() and list_del() are skipped: the
> overlay_changeset is kfree()d while still linked in ovcs_list and
> registered in ovcs_idr.
> 
> Every overlay removed through of_overlay_remove_all() thus leaves a
> dangling list node and idr entry behind. The next ovcs_list iteration
> or idr lookup walks freed memory, and the ids are never returned to
> the idr. Nothing in-tree calls of_overlay_remove_all() today, but it
> is the documented API for removing every overlay in one go
> (Documentation/devicetree/overlay-notes.rst), so any module user hits
> this deterministically.
> 
> Pass a local copy of the id, like every other of_overlay_remove()
> caller does.

If every caller passes a local and updating the value is not needed, 
then we should just update the API to pass the value rather than a 
reference.

Additionally, if there are no callers we should perhaps just remove the 
API.

Rob