usb: dwc3: of-simple: fix use-after-free on remove

[mirror_ubuntu-bionic-kernel.git] / drivers / of / resolver.c

diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c
index cfaeef5f6cb1c2c360d53d300bd61baaf0b867f3..0e9f87703bbac8294c8d88a9eb6a07ee47f1098e 100644 (file)
--- a/drivers/of/resolver.c
+++ b/drivers/of/resolver.c
@@ -128,6 +128,11 @@ static int update_usages_of_a_phandle_reference(struct device_node *overlay,
                        goto err_fail;
                }
 
+               if (offset < 0 || offset + sizeof(__be32) > prop->length) {
+                       err = -EINVAL;
+                       goto err_fail;
+               }
+
                *(__be32 *)(prop->value + offset) = cpu_to_be32(phandle);
        }