Hi Igor, Thank you for the patch.
On Sun, Jul 12, 2026 at 10:50, Igor Opaniuk <[email protected]> wrote: > run_avb_verification() allocates an AvbOps via avb_ops_alloc() but never > frees it on any return path. Every Android boot attempt therefore leaks > the AvbOpsData structure and, when CONFIG_OPTEE_TA_AVB is enabled, leaves > the OP-TEE session open (it is only closed inside avb_ops_free()). > > In addition, the AvbSlotVerifyData returned by avb_slot_verify() is only > released on the failure branches. The successful "return 0" paths (both > the locked GREEN/OK case and the unlocked ORANGE/ERROR_VERIFICATION case) > return without freeing it, leaking the whole out_data (cmdline and loaded > partition metadata) on every good boot. > > Route all exit paths through a single cleanup label that frees both > out_data and avb_ops. > > Fixes: 125d9f3306ea ("bootstd: Add a bootmeth for Android") > Signed-off-by: Igor Opaniuk <[email protected]> Good catch. Thank you for this! Reviewed-by: Mattijs Korpershoek <[email protected]>
