Sashiko says fdt_addr can point to either an allocated fdt or the fdt from
get_fdt() which is memory owned by FW.

Only the allocated fdt should be freed on the error unwind path. Use a
dedicated variable for the allocation's size so that the free does not get
confused.

Fixes: 4fc8e738ff3e ("efi: libstub: remove DT dependency from generic stub")
Signed-off-by: Jason Gunthorpe <[email protected]>
---
 drivers/firmware/efi/libstub/fdt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/libstub/fdt.c 
b/drivers/firmware/efi/libstub/fdt.c
index 23b3543d3041b0..5b2dd709d7b151 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -229,6 +229,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
        u32 desc_ver;
        efi_status_t status;
        struct exit_boot_struct priv;
+       unsigned long fdt_size_allocated = 0;
        unsigned long fdt_addr = 0;
        unsigned long fdt_size = 0;
 
@@ -257,6 +258,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
                        efi_err("Failed to load device tree!\n");
                        goto fail;
                }
+               fdt_size_allocated = fdt_size;
        }
 
        if (fdt_addr) {
@@ -334,7 +336,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
        efi_free(MAX_FDT_SIZE, *new_fdt_addr);
 
 fail:
-       efi_free(fdt_size, fdt_addr);
+       efi_free(fdt_size_allocated, fdt_addr);
        if (!efi_novamap)
                efi_bs_call(free_pool, priv.runtime_map);
 
-- 
2.43.0


Reply via email to