From 70fec428c845216da98041b1ae9f16a8f54b3d68 Mon Sep 17 00:00:00 2001 From: Andrea Parri Date: Mon, 21 Sep 2026 22:23:15 +0200 Subject: [PATCH] pstore: don't leave an ERR_PTR in the ramoops zone pointer ramoops_init_prz() stores the result of persistent_ram_new() in *prz and returns the error without clearing it when initialization fails. ramoops_probe() then cleans up through ramoops_free_przs(), which hands *prz to persistent_ram_free(); that treats the ERR_PTR as a valid zone and dereferences it, crashing the kernel. Clear *prz before returning so that cleanup sees a NULL zone. Fixes: b5d38e9bf1b0c ("pstore/ram: Add console messages handling") Assisted-by: LLM Signed-off-by: Andrea Parri Link: https://patch.msgid.link/20260921202317.70595-2-parri.andrea@gmail.com Signed-off-by: Kees Cook --- fs/pstore/ram.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c index 2eb0d4fa2186..aa056d0395a4 100644 --- a/fs/pstore/ram.c +++ b/fs/pstore/ram.c @@ -604,6 +604,7 @@ static int ramoops_init_prz(const char *name, if (IS_ERR(*prz)) { int err = PTR_ERR(*prz); + *prz = NULL; dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n", name, sz, (unsigned long long)*paddr, err); return err;