u-boot.git/lib/efi_loader, branch next

efi_loader: fix use of uninitialized guid in variable enumeration loops

2026-07-31T09:06:37Z

efi_bootmgr_delete_invalid_boot_option(), eficonfig_show_boot_selection(), and eficonfig_create_change_boot_order_entry() each enumerate all EFI variables by repeatedly calling efi_next_variable_name() in a loop, passing the same efi_guid_t as both input and output. GetNextVariableName() needs the vendor GUID returned by the previous call, together with the variable name it returned, to know where to resume. In each of these loops the efi_guid_t was declared inside the loop body, so a new instance comes into scope on every iteration. Relying on it to still hold the previous iteration's value depends on the compiler reusing the same stack slot across iterations, which is undefined behavior. With a compiler that zero-initializes locals by default (e.g. clang, or gcc configured with -ftrivial-auto-var-init=zero), the GUID is cleared on every iteration, so the lookup of the variable name returned by the previous call fails and efi_init_obj_list() aborts: Cannot initialize UEFI sub-system ** Booting bootflow ... with efi Boot failed (err=-22) Move the efi_guid_t declarations out of the loops so the value written by the previous efi_next_variable_name() call is preserved across iterations. Fixes: 140a8959d48f ("eficonfig: use efi_get_next_variable_name_int()") Signed-off-by: Scott Moser Reviewed-by: Heinrich Schuchardt

efi_loader: fix memory leak in efi_sigstore_parse_siglist

2026-07-31T09:00:44Z

In case of an error in efi_sigstore_parse_siglist() function efi_sigstore_free() is called. Currently it fails to free allocated data because siglist->sig_data_list is not set on the error path. Always update siglist->sig_data_list when a struct efi_sig_data is allocated. Suggested-by: Ilias Apalodimas Signed-off-by: Heinrich Schuchardt Reviewed-by: Ilias Apalodimas

efi_loader: check efi_deserialize_load_option() in get_dp_device()

2026-07-27T16:50:28Z

get_dp_device() reads a Boot#### variable and passes its contents to efi_deserialize_load_option() but ignores the return value. On failure efi_deserialize_load_option() may return without having initialised the caller's struct efi_load_option, and even on a malformed device path it sets lo.file_path before validating it with efi_dp_check_length(). As a result get_dp_device() can proceed to walk lo.file_path with efi_dp_split_file_path() (via efi_dp_dup()/efi_dp_size()) on a device path that was never validated, or on an uninitialised pointer when the variable is too short to be parsed. A device-path node with a length of zero makes the walk loop forever, and a length below the 4-byte node header leads to an out-of-bounds read. The Boot#### variable is attacker-controlled in threat models where writing EFI variables does not imply the ability to execute firmware code, so this is reachable during capsule-on-disk processing at boot. Check the return value and bail out, as every other caller of efi_deserialize_load_option() already does. Suggested-by: Hem Parekh Cc: Hem Parekh Signed-off-by: Heinrich Schuchardt Reviewed-by: Ilias Apalodimas

efi_loader: set correct frame buffer address

2026-07-27T16:50:27Z

If we use video copy, bit image transfers need to write to the in memory copy of the physical frame buffer. Damage control will sync the changes to the physical frame buffer. Cyclic video copy will catch all changes done by EFI applications directly accessing the frame buffer copy. gopobj->mode.fb_base must be a valid pointer to memory and not a virtual sandbox address. With this change the block image transfer test works again on the sandbox. setenv efi_selftest block image transfer bootefi selftest Fixes: a75cf70d23ac ("efi: Correct handling of frame buffer") Signed-off-by: Heinrich Schuchardt

efi_loader: Measure secure boot variables in the correct PCR if DeployedMode is set

2026-07-15T22:40:43Z

PK, KEK, db, dbx etc must always be measured in PCR7. DeployedMode and AuditMode should be measured in PCR1 if DeployedMode is set and PCR7 otherwise. Fix the u16_strcmp to only change the PCR value for those two variables. Signed-off-by: Ilias Apalodimas Acked-by: Heinrich Schuchardt

efi_loader: Change the return values if a TPM is missing during GetEventLog

2026-07-15T22:40:43Z

The function defined by the TCG spec looks like: typedef EFI_STATUS (EFIAPI *EFI_TCG2_GET_EVENT_LOG) ( IN EFI_TCG2_PROTOCOL *This, IN EFI_TCG2_EVENT_LOG_FORMAT EventLogFormat, OUT EFI_PHYSICAL_ADDRESS *EventLogLocation, OUT EFI_PHYSICAL_ADDRESS *EventLogLastEntry, OUT BOOLEAN *EventLogTruncated ); and the spec mandates that "If no TPM is present, the function SHALL set the following values and return EFI_SUCCESS: EventLogLocation = NULL EventLogLastEntry = NULL EventLogTruncated = FALSE" However, if we set it to NULL the local assignment is discarded when the function returns. Set it to 0, although on some platforms that's a valid address. Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt

efi_loader: Correctly count the size on DTB measurements

2026-07-15T22:40:42Z

When doing a sha256_update() for the measured DT, the size arguments for fdt_size_dt_struct() and fdt_size_dt_strings() are inversed. Signed-off-by: Ilias Apalodimas Acked-by: Heinrich Schuchardt

efi_loader: fix buffer overrun in efi_sigstore_parse_siglist

2026-07-15T22:40:42Z

In efi_sigstore_parse_siglist() sigdata is allocated. But instead of an allocation matching the size of sigdata, tainted external data was used to calculate the allocation size. This may lead to buffer overflows. * Correct the allocation size. * Follow the man-page. Use the structure size as second argument for calloc. Reviewed-by: Ilias Apalodimas Signed-off-by: Heinrich Schuchardt

efi_loader: fix building with CONFIG_EFI_VARIABLES_PRESEED=y

2026-07-15T22:40:42Z

Since commit bd3f9ee679b4 ("kbuild: Bump the build system to 6.1") out-of-tree builds with CONFIG_EFI_VARIABLES_PRESEED=y fail with errors like: ../lib/efi_loader/efi_var_seed.S:14: Error: file not found: ubootefi.var For out-of-tree build we cannot use CONFIG_EFI_VAR_SEED_FILE in the .incbin statement of file efi_var_seed.S. * We have to prepend $(srctree) if the path is relative. * We must not prepend $(srctree) if the path is absolute. Fixes: bd3f9ee679b4 ("kbuild: Bump the build system to 6.1") Reported-by: Jon Mason Closes: https://lore.kernel.org/u-boot/CAPoiz9zg4OXgHo5J3WtJHKOEuWOdCDrugWfAt6Z+d71j=+q8oA@mail.gmail.com/T/#mffaca10a9e812d03eceafad59999a02e57258b9a Tested-by: Nora Schiffer Reviewed-by: Ilias Apalodimas Tested-by: Ilias Apalodimas Signed-off-by: Heinrich Schuchardt

efi_loader: fix missing EFI_EXIT in efi_disconnect_controller

2026-07-15T22:40:42Z

We are missing a call to EFI_EXIT() when returning from efi_disconnect_controller(), which we need after having called EFI_ENTRY(). Fix this by jumping to the common error path, which does call EFI_EXIT(). Even though the common error path may try to free child_handle_buffer, this cannot harm in our case as it always NULL. This is inspired by a barebox fix. [1] Link: https://git.pengutronix.de/cgit/barebox/commit/?id=080db65e39a877b000baaf843c997a69821dfe69 [1] Fixes: 314bed6c854e ("efi_loader: fix DisconnectController() for sole child") Signed-off-by: Vincent Stehlé Cc: Heinrich Schuchardt Cc: Ilias Apalodimas Cc: Tom Rini Reviewed-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt