diff options
| author | Jason Gunthorpe <jgg@nvidia.com> | 2026-10-02 20:31:38 -0300 |
|---|---|---|
| committer | Ard Biesheuvel <ardb@kernel.org> | 2026-10-06 12:18:41 +0200 |
| commit | d83fe67339f2032d8facf0fe8a047a4c5d15394f (patch) | |
| tree | 99894c1a5c623ebeef77993c2d00e0936944825b | |
| parent | 1e50ed98255b2bf68fa881595c44c6be2a037ac0 (diff) | |
| download | linux-next-d83fe67339f2032d8facf0fe8a047a4c5d15394f.tar.gz linux-next-d83fe67339f2032d8facf0fe8a047a4c5d15394f.zip | |
efi/libstub: Fix error unwind freeing fdt in allocate_new_fdt_and_exit_boot()
Sashiko says fdt_addr can point to either an allocated fdt or the fdt from
get_fdt() which is memory owned by FW.
Only the allocated fdt should be freed on the error unwind path. Use a
dedicated variable for the allocation's size so that the free does not get
confused.
Fixes: 4fc8e738ff3e ("efi: libstub: remove DT dependency from generic stub")
Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
| -rw-r--r-- | drivers/firmware/efi/libstub/fdt.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c index 23b3543d3041..f01450b49975 100644 --- a/drivers/firmware/efi/libstub/fdt.c +++ b/drivers/firmware/efi/libstub/fdt.c @@ -229,6 +229,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle, u32 desc_ver; efi_status_t status; struct exit_boot_struct priv; + unsigned long fdt_size_allocated = 0; unsigned long fdt_addr = 0; unsigned long fdt_size = 0; @@ -251,12 +252,13 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle, if (strstr(cmdline_ptr, "dtb=")) efi_err("Ignoring DTB from command line.\n"); } else { - status = efi_load_dtb(image, &fdt_addr, &fdt_size); + status = efi_load_dtb(image, &fdt_addr, &fdt_size_allocated); if (status != EFI_SUCCESS && status != EFI_NOT_READY) { efi_err("Failed to load device tree!\n"); goto fail; } + fdt_size = fdt_size_allocated; } if (fdt_addr) { @@ -334,7 +336,7 @@ fail_free_new_fdt: efi_free(MAX_FDT_SIZE, *new_fdt_addr); fail: - efi_free(fdt_size, fdt_addr); + efi_free(fdt_size_allocated, fdt_addr); if (!efi_novamap) efi_bs_call(free_pool, priv.runtime_map); |