If load_other_segments() fails after image->elf_headers is assigned, the memory lifecycle is safely managed by the global kimage object and will be freed in arch_kimage_file_post_load_cleanup().
However, during a retry loop in image_load(), a subsequent iteration will allocate a new buffer and overwrite image->elf_headers. This permanently leaks the stale memory from the previous iteration before the global cleanup can track it. Fix this by explicitly freeing the stale `image->elf_headers` buffer before assigning the newly allocated headers. Cc: Catalin Marinas <[email protected]> Cc: Will Deacon <[email protected]> Cc: Thomas Huth <[email protected]> Cc: Breno Leitao <[email protected]> Cc: Andrew Morton <[email protected]> Cc: Yeoreum Yun <[email protected]> Cc: Baoquan He <[email protected]> Cc: [email protected] Fixes: 108aa503657e ("arm64: kexec_file: try more regions if loading segments fails") Signed-off-by: Jinjie Ruan <[email protected]> --- arch/arm64/kernel/machine_kexec_file.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c index e48f29167b38..2f750e5f4fcc 100644 --- a/arch/arm64/kernel/machine_kexec_file.c +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -112,6 +112,10 @@ int load_other_segments(struct kimage *image, vfree(headers); goto out_err; } + + if (unlikely(image->elf_headers)) + vfree(image->elf_headers); + image->elf_headers = headers; image->elf_load_addr = kbuf.mem; image->elf_headers_sz = headers_sz; -- 2.34.1
