vhaudiquet/u-boot-krane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

efi_selftest: fix use-after-free

Browse Source 
When the `memory' efi selftest verifies the Devicetree memory reservation,
it accesses the memory_map buffer after it has been freed with free_pool().
Move the verification earlier to fix this.

Fixes: 34c96659ed ("efi_selftest: check fdt is marked as runtime data")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
This commit is contained in:
Vincent Stehlé
2026-06-21 10:53:01 +02:00
committed by Heinrich Schuchardt
parent 41c6b83c77
commit 60ff3d9509
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/efi_selftest/efi_selftest_memory.c
+9 -8
View File
@@ -155,6 +155,15 @@ static int execute(void)
EFI_RUNTIME_SERVICES_DATA) != EFI_ST_SUCCESS)
return EFI_ST_FAILURE;
/* Check memory reservation for the device tree */
if (fdt_addr &&
find_in_memory_map(map_size, memory_map, desc_size, fdt_addr,
EFI_ACPI_RECLAIM_MEMORY) != EFI_ST_SUCCESS) {
efi_st_error
("Device tree not marked as ACPI reclaim memory\n");
return EFI_ST_FAILURE;
}
/* Free memory */
ret = boottime->free_pages(p1, EFI_ST_NUM_PAGES);
if (ret != EFI_SUCCESS) {
@@ -172,14 +181,6 @@ static int execute(void)
return EFI_ST_FAILURE;
}
/* Check memory reservation for the device tree */
if (fdt_addr &&
find_in_memory_map(map_size, memory_map, desc_size, fdt_addr,
EFI_ACPI_RECLAIM_MEMORY) != EFI_ST_SUCCESS) {
efi_st_error
("Device tree not marked as ACPI reclaim memory\n");
return EFI_ST_FAILURE;
}
return EFI_ST_SUCCESS;
}