The efi_http_service_binding_destroy_child() function uses the
efi_handler structure corresponding to the HTTP protocol, and pointed to
by phandler, after it has been freed by the call to efi_delete_handle().
Fix this by initializing the http_instance pointer before the deletion
and by not using phandler anymore after.
This has the nice side effect of making the code freeing http_instance
(arguably) more readable.
This can be verified on the sandbox, even without bridging the network,
with CONFIG_VALGRIND=y and the following command:
valgrind --suppressions=scripts/u-boot.supp \
./u-boot -T -c 'setenv efi_selftest http protocol; bootefi selftest'
We keep the code clearing the http_load_addr pointer in the structure
pointed to by http_instance after freeing the load buffer for the sake of
regularity, even though we will free() it on the next line.
Fixes: 5753dc3f6572 ("efi_loader: Prevent dereference of uninitialised
variable")
Signed-off-by: Vincent Stehlé <[email protected]>
Cc: Heinrich Schuchardt <[email protected]>
Cc: Ilias Apalodimas <[email protected]>
Cc: Tom Rini <[email protected]>
Cc: Andrew Goodbody <[email protected]>
---
Hi,
If you prefer I could also remove the (useless but regular) clearing of the
load buffer pointer in http_instance:
478 http_instance->http_load_addr = NULL;
Just let me know and I will send a v2.
Best regards,
Vincent.
---
lib/efi_loader/efi_http.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/lib/efi_loader/efi_http.c b/lib/efi_loader/efi_http.c
index d26b2119d6f..5c6367a9e53 100644
--- a/lib/efi_loader/efi_http.c
+++ b/lib/efi_loader/efi_http.c
@@ -467,15 +467,17 @@ static efi_status_t EFIAPI
efi_http_service_binding_destroy_child(
goto out;
}
+ http_instance = phandler->protocol_interface;
+
+ /* This will free *phandler */
ret = efi_delete_handle(child_handle);
if (ret != EFI_SUCCESS)
goto out;
- http_instance = phandler->protocol_interface;
efi_free_pool(http_instance->http_load_addr);
http_instance->http_load_addr = NULL;
- free(phandler->protocol_interface);
+ free(http_instance);
num_instances--;
out:
---
base-commit: 32ebe922e574a733d01c3f106fa77d9176bfecad
change-id: 20261013-deschi-833e1e27ec32
Best regards,
--
Vincent.
