From 074066790c7f726f149c1974e01b8b3f75738c73 Mon Sep 17 00:00:00 2001 From: Martin Schwan Date: Wed, 13 Aug 2025 13:54:05 +0200 Subject: [PATCH 1/4] bootstd: rauc: Fix segfault when cleaning up slots Fix a segfault when cleaning up the slots from the private struct. This fault was generated by accessing a member of a null pointer. Signed-off-by: Martin Schwan Tested-by: Wadim Egorov --- boot/bootmeth_rauc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c index cc6180221ed..a27c85c4ff0 100644 --- a/boot/bootmeth_rauc.c +++ b/boot/bootmeth_rauc.c @@ -187,7 +187,7 @@ static int distro_rauc_read_bootflow(struct udevice *dev, struct bootflow *bflow ret = distro_rauc_scan_parts(bflow); if (ret < 0) { - for (i = 0; priv->slots[i]->name; i++) { + for (i = 0; priv->slots[i]; i++) { free(priv->slots[i]->name); free(priv->slots[i]); } From b389967f9a624b35c163767c34919cbdcd4e0917 Mon Sep 17 00:00:00 2001 From: Martin Schwan Date: Wed, 13 Aug 2025 13:54:06 +0200 Subject: [PATCH 2/4] bootstd: rauc: Don't null bootflow->bootmeth_priv Don't null bootflow->bootmeth_priv, as the private struct is freed later on by the bootflow. Signed-off-by: Martin Schwan Tested-by: Wadim Egorov --- boot/bootmeth_rauc.c | 1 - 1 file changed, 1 deletion(-) diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c index a27c85c4ff0..c8efdce75b9 100644 --- a/boot/bootmeth_rauc.c +++ b/boot/bootmeth_rauc.c @@ -193,7 +193,6 @@ static int distro_rauc_read_bootflow(struct udevice *dev, struct bootflow *bflow } free(priv); free(boot_order_copy); - bflow->bootmeth_priv = NULL; return ret; } From 302830499d9f0ebec42fe62254429a4d8db6b36c Mon Sep 17 00:00:00 2001 From: Martin Schwan Date: Wed, 13 Aug 2025 13:54:07 +0200 Subject: [PATCH 3/4] bootstd: rauc: Move freeing private struct to its own function Move freeing a distro_rauc_priv struct to a new, separate function for better reuse. Signed-off-by: Martin Schwan Tested-by: Wadim Egorov --- boot/bootmeth_rauc.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c index c8efdce75b9..f781a7fc0b5 100644 --- a/boot/bootmeth_rauc.c +++ b/boot/bootmeth_rauc.c @@ -52,6 +52,18 @@ struct distro_rauc_priv { struct distro_rauc_slot **slots; }; +static void distro_rauc_priv_free(struct distro_rauc_priv *priv) +{ + int i; + + for (i = 0; priv->slots[i]; i++) { + free(priv->slots[i]->name); + free(priv->slots[i]); + } + free(priv->slots); + free(priv); +} + static struct distro_rauc_slot *get_slot(struct distro_rauc_priv *priv, const char *slot_name) { @@ -187,11 +199,7 @@ static int distro_rauc_read_bootflow(struct udevice *dev, struct bootflow *bflow ret = distro_rauc_scan_parts(bflow); if (ret < 0) { - for (i = 0; priv->slots[i]; i++) { - free(priv->slots[i]->name); - free(priv->slots[i]); - } - free(priv); + distro_rauc_priv_free(priv); free(boot_order_copy); return ret; } From 498e423457a0360c01d976aa21a218995a1bdef8 Mon Sep 17 00:00:00 2001 From: Martin Schwan Date: Wed, 13 Aug 2025 13:54:08 +0200 Subject: [PATCH 4/4] bootstd: rauc: Free private data when booting The private data struct can be freed when loading the boot script, as we don't need the slot information anymore at this point. Signed-off-by: Martin Schwan Tested-by: Wadim Egorov --- boot/bootmeth_rauc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/boot/bootmeth_rauc.c b/boot/bootmeth_rauc.c index f781a7fc0b5..9c082dabd2b 100644 --- a/boot/bootmeth_rauc.c +++ b/boot/bootmeth_rauc.c @@ -409,6 +409,8 @@ static int distro_rauc_boot(struct udevice *dev, struct bootflow *bflow) if (ret) return log_msg_ret("boot", ret); + distro_rauc_priv_free(priv); + return 0; }