If the malloc() for the UPL handoff structure failed, ret was checked
while still uninitialized, leading to undefined behavior: either a bogus
error code was returned or, if ret happened to be zero, gd_set_upl() was
called with a NULL pointer. Bail out with -ENOMEM on allocation failure
and only read ret after upl_read_handoff() has set it.
Fixes: 0fc406ab20e ("upl: Plumb in universal payload to the init process")
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
---
common/board_f.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/common/board_f.c b/common/board_f.c
index 59f1f173a27..ead7b6dd743 100644
--- a/common/board_f.c
+++ b/common/board_f.c
@@ -903,8 +903,10 @@ static int initf_upl(void)
return 0;
upl = malloc(sizeof(struct upl));
- if (upl)
- ret = upl_read_handoff(upl, oftree_default());
+ if (!upl)
+ return -ENOMEM;
+
+ ret = upl_read_handoff(upl, oftree_default());
if (ret) {
printf("UPL handoff: read failure (err=%dE)\n", ret);
return ret;
--
2.43.0
