[PATCH] of/overlay: don't pass the changeset's own id to of_overlay_remove()

[Abdurrahman Hussain]

of_overlay_remove_all() passes &ovcs->id to of_overlay_remove(), which
zeroes *ovcs_id once the changeset is reverted, before calling
free_overlay_changeset(). Through the aliased pointer that zeroes
ovcs->id itself, so free_overlay_changeset()'s "ovcs->id > 0" guard
is false and both idr_remove() and list_del() are skipped: the
overlay_changeset is kfree()d while still linked in ovcs_list and
registered in ovcs_idr.

Every overlay removed through of_overlay_remove_all() thus leaves a
dangling list node and idr entry behind. The next ovcs_list iteration
or idr lookup walks freed memory, and the ids are never returned to
the idr. Nothing in-tree calls of_overlay_remove_all() today, but it
is the documented API for removing every overlay in one go
(Documentation/devicetree/overlay-notes.rst), so any module user hits
this deterministically.

Pass a local copy of the id, like every other of_overlay_remove()
caller does.

Reported-by: Sashiko AI <sashiko-bot@xxxxxxxxxx>
Closes: https://lore.kernel.org/20260901014554.83A8D1F000E9@xxxxxxxxxxxxxxx
Fixes: 24789c5ce5a3 ("of: overlay: detect cases where device tree may become corrupt")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@xxxxxxxxxx>
---
 drivers/of/overlay.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index 83c56dd9b5d8..f66f16cddc79 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -1297,7 +1297,9 @@ int of_overlay_remove_all(void)
 
 	/* the tail of list is guaranteed to be safe to remove */
 	list_for_each_entry_safe_reverse(ovcs, ovcs_n, &ovcs_list, ovcs_list) {
-		ret = of_overlay_remove(&ovcs->id);
+		int id = ovcs->id;
+
+		ret = of_overlay_remove(&id);
 		if (ret)
 			return ret;
 	}

---
base-commit: 21c89ff1fc86ffa517f3a9ca1ba5c48e9e37c1ba
change-id: 20260917-b4-of-overlay-remove-all-fix-9fafc8104ea0

Best regards,
--  
Abdurrahman Hussain <abdurrahman@xxxxxxxxxx>