setenv("global.bootm.root_param", getenv("global.bootm.root_param"))
triggers a use-after-free, because the value is free'd before being
duplicated and allocated again.Let's just early exit in this case as there's nothing further to do. This was noticed by KASAN when bootm_data_restore_defaults restored global.bootm.root_param. Signed-off-by: Ahmad Fatoum <[email protected]> --- lib/parameter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/parameter.c b/lib/parameter.c index b9a449c32657..bf5dbbb05e6b 100644 --- a/lib/parameter.c +++ b/lib/parameter.c @@ -131,6 +131,8 @@ int bobject_set_param(bobject_t _bobj, const char *name, const char *val) int bobject_param_set_generic(bobject_t _bobj, struct param_d *p, const char *val) { + if (val == p->value) + return 0; free(p->value); if (!val) { p->value = NULL; -- 2.47.3
