On Thu, 24 Sep 2026 10:53:04 -0300
Jason Gunthorpe <[email protected]> wrote:
> Sashiko says fdt_addr can point to either an allocated fdt or the fdt from
> get_fdt() which is memory owned by FW.
>
> Only the allocated fdt should be freed on the error unwind path. Use a
> dedicated variable for the allocation's size so that the free does not get
> confused.
>
> Fixes: 4fc8e738ff3e ("efi: libstub: remove DT dependency from generic stub")
> Signed-off-by: Jason Gunthorpe <[email protected]>
> ---
> drivers/firmware/efi/libstub/fdt.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/firmware/efi/libstub/fdt.c
> b/drivers/firmware/efi/libstub/fdt.c
> index 23b3543d3041b0..5b2dd709d7b151 100644
> --- a/drivers/firmware/efi/libstub/fdt.c
> +++ b/drivers/firmware/efi/libstub/fdt.c
> @@ -229,6 +229,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
> u32 desc_ver;
> efi_status_t status;
> struct exit_boot_struct priv;
> + unsigned long fdt_size_allocated = 0;
> unsigned long fdt_addr = 0;
> unsigned long fdt_size = 0;
>
> @@ -257,6 +258,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
> efi_err("Failed to load device tree!\n");
> goto fail;
> }
> + fdt_size_allocated = fdt_size;
Hmm. I argued with myself for a while on this. Which one of fdt_size and
fdt_size_allocate
is the appropriate one to pass to the call? In the end I didn't get a good
answer so
oh I guess this is as good as the other way around.
Bug looks real to me and this fixes it I think. Give I know this code very
little
take this tag with a pinch of salt.
Reviewed-by: Jonathan Cameron <[email protected]>
> }
>
> if (fdt_addr) {
> @@ -334,7 +336,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(void *handle,
> efi_free(MAX_FDT_SIZE, *new_fdt_addr);
>
> fail:
> - efi_free(fdt_size, fdt_addr);
> + efi_free(fdt_size_allocated, fdt_addr);
> if (!efi_novamap)
> efi_bs_call(free_pool, priv.runtime_map);
>
