biosemu_run() can be called with a BIOS image supplied by the caller
(dm_pci_run_vga_bios() calls it with an image, so bios_rom is not NULL)
or with no image so that it makes its own copy from the card's ROM
(BootVideoCardBIOS() calls it with no image, so bios_rom is NULL).
In the first case, the image is either at PCI_VGA_RAM_IMAGE_START
(0xc0000) on x86, or a buffer owned by the caller. In the second case,
the image is a buffer malloc()ed by PCI_postController() (which
biosemu_run() calls). The clean up path in biosemu_run() should only
free up the image in this case.
However, the clean up path frees the image in both cases, which can
result in the freeing up a buffer owned by the caller in the first case
(dm_pci_run_vga_bios()). This can cause a double free when the caller
tries freeing up the buffer again. There is a currently a check to
prevent this from happen on x86 (vga_info->BIOSImage != 0xc0000), but
nothing stops this on other architectures.
Update the clean up path to only free the image when biosemu_run() made
the copy itself (i.e. bios_rom is NULL). The existing checks for
vga_info->BIOSImage not being NULL or 0xc0000 can then be dropped, as
this copy is never at 0xc0000 and free(NULL) is safe.
Fixes: 4c59f9532796 ("bios_emulator: Add vesa support and allow ROMs to be
passed in as data")
Signed-off-by: Anirudh Srinivasan <[email protected]>
---
drivers/bios_emulator/atibios.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/bios_emulator/atibios.c b/drivers/bios_emulator/atibios.c
index e992a1aa822..b8c962d5832 100644
--- a/drivers/bios_emulator/atibios.c
+++ b/drivers/bios_emulator/atibios.c
@@ -509,8 +509,7 @@ int biosemu_run(struct udevice *pcidev, uchar *bios_rom,
int bios_len,
*/
if (clean_up) {
BE_exit();
- if (vga_info->BIOSImage &&
- (ulong)(vga_info->BIOSImage) != 0xc0000)
+ if (!bios_rom)
free(vga_info->BIOSImage);
free(vga_info);
}
--
2.43.0
