diff options
| author | Vincent Stehlé <[email protected]> | 2026-06-11 08:59:50 +0200 |
|---|---|---|
| committer | Heinrich Schuchardt <[email protected]> | 2026-06-21 10:53:01 +0200 |
| commit | 60ff3d950996c2ea0bb744fd9c922a96abc65774 (patch) | |
| tree | a5020bf2ca9a13da732df422a2c244a394d21ada | |
| parent | 41c6b83c777788692640fa0f85a2381d8959f301 (diff) | |
efi_selftest: fix use-after-free
When the `memory' efi selftest verifies the Devicetree memory reservation,
it accesses the memory_map buffer after it has been freed with free_pool().
Move the verification earlier to fix this.
Fixes: 34c96659ed57 ("efi_selftest: check fdt is marked as runtime data")
Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Heinrich Schuchardt <[email protected]>
Cc: Ilias Apalodimas <[email protected]>
Cc: Tom Rini <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
| -rw-r--r-- | lib/efi_selftest/efi_selftest_memory.c | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/lib/efi_selftest/efi_selftest_memory.c b/lib/efi_selftest/efi_selftest_memory.c index 7320964c129..450470ceedd 100644 --- a/lib/efi_selftest/efi_selftest_memory.c +++ b/lib/efi_selftest/efi_selftest_memory.c @@ -155,6 +155,15 @@ static int execute(void) EFI_RUNTIME_SERVICES_DATA) != EFI_ST_SUCCESS) return EFI_ST_FAILURE; + /* Check memory reservation for the device tree */ + if (fdt_addr && + find_in_memory_map(map_size, memory_map, desc_size, fdt_addr, + EFI_ACPI_RECLAIM_MEMORY) != EFI_ST_SUCCESS) { + efi_st_error + ("Device tree not marked as ACPI reclaim memory\n"); + return EFI_ST_FAILURE; + } + /* Free memory */ ret = boottime->free_pages(p1, EFI_ST_NUM_PAGES); if (ret != EFI_SUCCESS) { @@ -172,14 +181,6 @@ static int execute(void) return EFI_ST_FAILURE; } - /* Check memory reservation for the device tree */ - if (fdt_addr && - find_in_memory_map(map_size, memory_map, desc_size, fdt_addr, - EFI_ACPI_RECLAIM_MEMORY) != EFI_ST_SUCCESS) { - efi_st_error - ("Device tree not marked as ACPI reclaim memory\n"); - return EFI_ST_FAILURE; - } return EFI_ST_SUCCESS; } |