diff options
| author | Vincent Stehlé <[email protected]> | 2026-01-27 17:18:43 +0100 |
|---|---|---|
| committer | Heinrich Schuchardt <[email protected]> | 2026-02-06 09:32:32 +0100 |
| commit | beec6834544d8288d34ef0cd8e3c40aa890a8a10 (patch) | |
| tree | 6c92b3ed432c1e6ce295749981fc6af641674438 /lib/efi_loader | |
| parent | b5213bbfdcb1812be510427857827ee8becb9f8f (diff) | |
efi_loader: fix use after free in efi_exit() with tcg2
The efi_exit() function frees the loaded image memory by calling
efi_delete_image(). However, when CONFIG_EFI_TCG2_PROTOCOL is enabled, the
image_obj->image_type structure member is accessed after the memory has
been freed.
Fix this by performing the tcg2 measurement before the image deletion.
Fixes: 8fc4e0b4273a ("efi_loader: add boot variable measurement")
Suggested-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Heinrich Schuchardt <[email protected]>
Cc: Tom Rini <[email protected]>
Cc: Masahisa Kojima <[email protected]>
Acked-by: Masahisa Kojima <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
Diffstat (limited to 'lib/efi_loader')
| -rw-r--r-- | lib/efi_loader/efi_boottime.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index ddc935d2240..b424d924896 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -3494,12 +3494,6 @@ static efi_status_t EFIAPI efi_exit(efi_handle_t image_handle, if (ret != EFI_SUCCESS) EFI_PRINT("%s: out of memory\n", __func__); } - /* efi_delete_image() frees image_obj. Copy before the call. */ - exit_jmp = image_obj->exit_jmp; - *image_obj->exit_status = exit_status; - if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION || - exit_status != EFI_SUCCESS) - efi_delete_image(image_obj, loaded_image_protocol); if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) { if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) { @@ -3510,6 +3504,13 @@ static efi_status_t EFIAPI efi_exit(efi_handle_t image_handle, } } + /* efi_delete_image() frees image_obj. Copy before the call. */ + exit_jmp = image_obj->exit_jmp; + *image_obj->exit_status = exit_status; + if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION || + exit_status != EFI_SUCCESS) + efi_delete_image(image_obj, loaded_image_protocol); + /* Make sure entry/exit counts for EFI world cross-overs match */ EFI_EXIT(exit_status); |