u-boot.git/boot, branch next

tools: fit: sign all config image references

2026-08-25T23:12:40Z

Target-side configuration verification builds the signed-region list from every image-reference property in the selected configuration. Host-side signing still uses either the signature node sign-images property or the legacy kernel/fdt/script default list. This lets mkimage generate configuration signatures which U-Boot cannot verify when the configuration references other image types, such as firmware, loadables or ramdisk entries. It also lets the host and target disagree when sign-images names only a subset of the configuration images. Build the host-side signing list from the configuration properties in the same way as target-side verification. Use one shared property classifier so the host and target cannot drift apart again. This makes signed configurations cover the root node, the configuration node, every referenced image node, and its hash, cipher and dm-verity subnodes, regardless of image type. Warn when a legacy sign-images property is present, since it no longer limits the signed image list. Require every referenced image to have at least one hash subnode. Add sandbox coverage proving that a firmware reference omitted from sign-images is still recorded in hashed-nodes and verified. Update the signed-configuration documentation to describe the same rule and the hash-subnode requirement. Fixes: 2092322b31cc ("boot: Add fit_config_get_hash_list() to build signed node list") Signed-off-by: James Hilliard Reviewed-by: Simon Glass

Merge tag 'v2026.10-rc3' into next

2026-08-25T01:31:25Z

boot: image-fdt: Restore suppression of irrelevant ERROR message

2026-08-24T19:58:00Z

The commit 623f6c5b6ab7 ("boot: image-fdt: free old dtb reservations") removed the suppression of ERROR messages when -EINVAL was returned due to the memory region not being part of the LMB memory map. This causes an irrelevant ERROR message during boot, e.g.: Model: Radxa ROCK 3B [...] ERROR: reserving fdt memory region failed (addr=10f000 size=100 flags=2): -22 or Model: Rockchip RK3288 Asus Tinker Board S [...] ERROR: reserving fdt memory region failed (addr=fe000000 size=1000000 flags=4): -22 FDT correctly contains reserved-memory for 10f000 or fe000000 and U-Boot correctly does not make these regions available in the LMB memory map: memory[0] [0x200000-0xefffffff], 0xefe00000 bytes, flags: none memory[1] [0x100000000-0x1ffffffff], 0x100000000 bytes, flags: none or memory[0] [0x0-0x7fffffff], 0x80000000 bytes, flags: none With lmb_alloc_mem() and lmb_free() both returning -EFAULT when the requested memory region is not part of the LMB memory map it should be safe to ignore these errors when FDT memreserve and reserved-memory is being processed. Print -EFAULT errors using a debug message to restore suppression of this irrelevant ERROR message when memory region is not part of the LMB memory map. Fixes: 623f6c5b6ab7 ("boot: image-fdt: free old dtb reservations") Signed-off-by: Jonas Karlman Reviewed-by: Randolph Sapp

bootstd: rauc: Clear bootmeth_priv after freeing it when booting

2026-08-21T23:20:57Z

distro_rauc_boot() deep-frees the private data once the boot script has been loaded and run, but leaves bflow->bootmeth_priv pointing at the freed memory. The bootflow being booted is the one stored in the bootstd list, so if the boot script returns (bootflow_boot() treats this as an error), the stale pointer is kept and bootflow_free() frees it a second time when the bootflow is removed, for example by the next 'bootflow scan'. Clear bflow->bootmeth_priv after freeing, as the scan error path does. Also check priv before using it, like the other users of bootmeth_priv in this file: after a failed boot attempt, a retry now finds bootmeth_priv NULL and must not hand it to get_slot(), which would dereference it. Fixes: 498e423457a0 ("bootstd: rauc: Free private data when booting") Signed-off-by: Aristo Chen

bootstd: Free abandoned bootflows while scanning

2026-08-21T23:20:57Z

bootflow_scan_first()/bootflow_scan_next() try each candidate (bootdev, method, partition) in turn. When a candidate fails and is not returned to the caller (no BOOTFLOWIF_ALL), the bootflow is simply abandoned: the next candidate's bootflow_init() memsets the struct, orphaning everything the failed attempt allocated, starting with the name allocated in bootdev_find_in_blk(). Each failed candidate therefore leaks its allocations on every scan. A single failing 'bootflow scan' on a sandbox MMC with a RAUC A/B layout leaks about 1 KB across ~30 abandoned candidates, and scans can be retried indefinitely from the U-Boot prompt. Free the bootflow when it failed and is not passed back to the caller. Add a check to the bootflow_rauc test that repeating a failing scan does not change the number of allocated bytes. Together with the previous RAUC fixes this makes the failed-scan path leak-free. Fixes: a8f5be178db5 ("bootstd: Add support for bootflows") Signed-off-by: Aristo Chen

bootstd: rauc: Fix leak of the strsep() source buffers

2026-08-21T23:20:56Z

distro_rauc_read_bootflow() duplicates the default boot order and the partition list with strdup(), then parses both with strsep(), which advances the pointers until they are NULL. The error path then calls free() on the advanced pointers, which is a no-op, and the success path does not free them at all. The two buffers leak on every RAUC read_bootflow() call. This also removes a landmine: if the two lists ever had different lengths, the leftover pointer would point into the middle of its buffer and free() would be called on an interior pointer, corrupting the heap. Parse via separate cursor variables and free the original pointers on both paths. Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc") Signed-off-by: Aristo Chen

bootstd: cros: Clear bootmeth_priv after freeing it on error

2026-08-21T23:20:56Z

cros_read_bootflow() stores priv in bflow->bootmeth_priv and then calls cros_read_info(). If that fails, priv is freed but bflow->bootmeth_priv keeps pointing at the freed memory. With 'bootflow scan -a', failed bootflows are stored in the bootstd list, so the stale pointer is kept and bootflow_free() later frees it a second time, corrupting the heap. This is the same problem recently fixed in the RAUC bootmeth. Clear bflow->bootmeth_priv after freeing, as bootmeth_android already does. Fixes: 71f634b822ae ("bootstd: cros: Allow detection of any kernel partition") Signed-off-by: Aristo Chen

bootstd: rauc: Free string lists on error paths

2026-08-21T23:20:56Z

str_to_list() allocates a copy of the input string plus a pointer array, which must be released with str_free_list(). Several error paths return early without doing so and leak both allocations: - distro_rauc_scan_parts() when BOOT_ORDER names an unknown slot - distro_rauc_read_bootflow() and find_active_slot() when reading or writing a BOOT_*_LEFT variable fails The scan_parts leak is the most visible one: a stray BOOT_ORDER entry leaks the list on every scan attempt, and scans can be retried indefinitely from the U-Boot prompt. Free the list before each early return. Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc") Fixes: f271b0627001 ("bootstd: rauc: Only scan all partitions instead of boot files") Signed-off-by: Aristo Chen

bootstd: rauc: Clear bootmeth_priv after freeing it on error

2026-08-21T23:20:56Z

distro_rauc_read_bootflow() stores priv in bflow->bootmeth_priv before calling distro_rauc_scan_parts(). If the scan fails, the error path frees priv via distro_rauc_priv_free() but leaves bflow->bootmeth_priv pointing at the freed memory. With 'bootflow scan -a', failed bootflows are stored in the bootstd list, so the stale pointer is kept. The next scan (or any other bootflow removal) calls bootflow_free(), which frees bootmeth_priv again. On sandbox, dlmalloc catches the double free: common/dlmalloc.c:816: do_check_inuse_chunk: Assertion `inuse(p)' failed. The scan can fail this way whenever no slot has a valid filesystem, or when BOOT_ORDER names an unknown slot. Clear bflow->bootmeth_priv after freeing, as bootmeth_android already does. Extend the bootflow_rauc test to run a failing scan with -a and then rescan. Fixes: 284855320282 ("bootstd: rauc: Free memory during error handling") Signed-off-by: Aristo Chen

bootstd: rauc: Fix NULL dereference in get_slot()

2026-08-21T23:20:56Z

priv->slots is a NULL-terminated array of pointers, but get_slot() tests priv->slots[i]->name in its loop condition, dereferencing each entry before checking it against NULL. When slot_name does not match any configured slot, the loop reaches the terminator and dereferences a NULL pointer. This is reachable from the BOOT_ORDER environment variable: an entry naming a slot that is not listed in CONFIG_BOOTMETH_RAUC_PARTITIONS crashes U-Boot in distro_rauc_scan_parts() or distro_rauc_boot(). Since BOOT_ORDER is typically stored in a disk-resident environment written by the OS, a stray or corrupted value must not crash the bootloader. Test the array entry itself before using its name, as distro_rauc_priv_free() already does. Both callers already handle a NULL return. Extend the bootflow_rauc test to scan with a BOOT_ORDER naming an unconfigured slot. Without this fix the test crashes with SIGSEGV. Fixes: 7e5c2c782fb9 ("bootstd: Add implementation for bootmeth rauc") Signed-off-by: Aristo Chen