Sashiko says fdt_addr can point to either an allocated fdt or the fdt from
get_fdt() which is memory owned by FW.
Only the allocated fdt should be freed on the error unwind path. Use a
dedicated variable for the allocation's size so that the free does not get
confused.
Fixes: 4fc8e738ff3e ("efi: libstub: remove DT dependency from generic stub")
Signed-off-by: Jason Gunthorpe <[email protected]>
---
drivers/firmware/efi/libstub/fdt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/efi/libstub/fdt.c
b/drivers/firmware/efi/libstub/fdt.c
index 23b3543d3041b0..5b2dd709d7b151 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -229,6 +229,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
u32 desc_ver;
efi_status_t status;
struct exit_boot_struct priv;
+ unsigned long fdt_size_allocated = 0;
unsigned long fdt_addr = 0;
unsigned long fdt_size = 0;
@@ -257,6 +258,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
efi_err("Failed to load device tree!\n");
goto fail;
}
+ fdt_size_allocated = fdt_size;
}
if (fdt_addr) {
@@ -334,7 +336,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
efi_free(MAX_FDT_SIZE, *new_fdt_addr);
fail:
- efi_free(fdt_size, fdt_addr);
+ efi_free(fdt_size_allocated, fdt_addr);
if (!efi_novamap)
efi_bs_call(free_pool, priv.runtime_map);
--
2.43.0