Re: [PATCH 1/6] xen/dt-overlay: fix double-free of rangesets on attach failure

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

On Wed, 15 Apr 2026, Luca Fancellu wrote:
> Hi Michal,
> 
> > On 15 Apr 2026, at 12:36, Michal Orzel <michal.orzel@xxxxxxx> wrote:
> > 
> > handle_attach_overlay_nodes() destroys the IRQ and IOMEM rangesets on
> > failure but leaves the pointers dangling in the tracker entry. A
> > subsequent handle_remove_overlay_nodes() for the same overlay will call
> > rangeset_consume_ranges() on freed memory followed by a second
> > rangeset_destroy(), resulting in use-after-free and double-free.
> > 
> > NULL the pointers after rangeset_destroy() so that remove_nodes() and
> > handle_remove_overlay_nodes() skip the stale entries.
> > 
> > Fixes: 4c733873b5c2 ("xen/arm: Add XEN_DOMCTL_dt_overlay and device 
> > attachment to domains")
> > Reported-by: Gyujeong Jin <wlsrbwjd7232@xxxxxxxxx>
> > Signed-off-by: Michal Orzel <michal.orzel@xxxxxxx>
> > ---
> 
> Looks ok to me
> 
> Reviewed-by: Luca Fancellu <luca.fancellu@xxxxxxx>

Acked-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>