Hi Igor,

Thank you for the patch.

On Sun, Jul 12, 2026 at 10:50, Igor Opaniuk <[email protected]> wrote:

> run_avb_verification() allocates an AvbOps via avb_ops_alloc() but never
> frees it on any return path. Every Android boot attempt therefore leaks
> the AvbOpsData structure and, when CONFIG_OPTEE_TA_AVB is enabled, leaves
> the OP-TEE session open (it is only closed inside avb_ops_free()).
>
> In addition, the AvbSlotVerifyData returned by avb_slot_verify() is only
> released on the failure branches. The successful "return 0" paths (both
> the locked GREEN/OK case and the unlocked ORANGE/ERROR_VERIFICATION case)
> return without freeing it, leaking the whole out_data (cmdline and loaded
> partition metadata) on every good boot.
>
> Route all exit paths through a single cleanup label that frees both
> out_data and avb_ops.
>
> Fixes: 125d9f3306ea ("bootstd: Add a bootmeth for Android")
> Signed-off-by: Igor Opaniuk <[email protected]>

Good catch. Thank you for this!

Reviewed-by: Mattijs Korpershoek <[email protected]>

Reply via email to