[PATCH] efi_loader: fix image and load_options leak on FDT load failure

[PATCH] efi_loader: fix image and load_options leak on FDT load failure

[Yuho Choi]

When efi_bootmgr_run() attempts to load an FDT specified in the active
Boot#### option on non-ACPI platforms, load_fdt_from_load_option() may
fail (e.g. if the file is missing or unreadable).

In this failure path, efi_bootmgr_run() returns the error code immediately,
skipping the cleanup code at the end of the function. This leaks the loaded
image handle, allocated memory pages, loaded image protocol, and the
malloc'd load_options buffer.

Fix this by jumping to the cleanup label 'out' so that efi_unload_image()
and free(load_options) are called before returning.

Fixes: 39bac24a48b0 ("efi_loader: load device-tree specified in boot option")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
 lib/efi_loader/efi_bootmgr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/efi_loader/efi_bootmgr.c b/lib/efi_loader/efi_bootmgr.c
index 51ecb6ec1f..934f0c4060 100644
--- a/lib/efi_loader/efi_bootmgr.c
+++ b/lib/efi_loader/efi_bootmgr.c
@@ -1323,7 +1323,7 @@ efi_status_t efi_bootmgr_run(void *fdt)
 		if (!fdt) {
 			ret = load_fdt_from_load_option(&fdt_lo);
 			if (ret != EFI_SUCCESS)
-				return ret;
+				goto out;
 			if (fdt_lo)
 				fdt = fdt_lo;
 		}
@@ -1339,6 +1339,7 @@ efi_status_t efi_bootmgr_run(void *fdt)
 	 */
 	ret = efi_install_fdt(fdt);
 
+out:
 	if (!IS_ENABLED(CONFIG_GENERATE_ACPI_TABLE)) {
 		free(fdt_lo);
 		if (fdt_distro)
-- 
2.43.0

Re: [PATCH] efi_loader: fix image and load_options leak on FDT load failure

[Carlo Caione]

On Thu, Oct 22, 2026 at 17:44:28 +0100, Yuho Choi wrote:
> When efi_bootmgr_run() attempts to load an FDT specified in the active
> Boot#### option on non-ACPI platforms, load_fdt_from_load_option() may
> fail (e.g. if the file is missing or unreadable).
> 
> In this failure path, efi_bootmgr_run() returns the error code immediately,
> skipping the cleanup code at the end of the function. This leaks the loaded
> image handle, allocated memory pages, loaded image protocol, and the
> malloc'd load_options buffer.
> 
> Fix this by jumping to the cleanup label 'out' so that efi_unload_image()
> and free(load_options) are called before returning.
> 
> Fixes: 39bac24a48b0 ("efi_loader: load device-tree specified in boot option")
> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>

I think this should be 39bac24a48bb. Besides that:

Reviewed-by: Carlo Caione <ccaione@baylibre.com>

> ---
>  lib/efi_loader/efi_bootmgr.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/efi_loader/efi_bootmgr.c b/lib/efi_loader/efi_bootmgr.c
> index 51ecb6ec1f..934f0c4060 100644
> --- a/lib/efi_loader/efi_bootmgr.c
> +++ b/lib/efi_loader/efi_bootmgr.c
> @@ -1323,7 +1323,7 @@ efi_status_t efi_bootmgr_run(void *fdt)
>  		if (!fdt) {
>  			ret = load_fdt_from_load_option(&fdt_lo);
>  			if (ret != EFI_SUCCESS)
> -				return ret;
> +				goto out;
>  			if (fdt_lo)
>  				fdt = fdt_lo;
>  		}
> @@ -1339,6 +1339,7 @@ efi_status_t efi_bootmgr_run(void *fdt)
>  	 */
>  	ret = efi_install_fdt(fdt);
>  
> +out:
>  	if (!IS_ENABLED(CONFIG_GENERATE_ACPI_TABLE)) {
>  		free(fdt_lo);
>  		if (fdt_distro)
> -- 
> 2.43.0
> 

Re: [PATCH] efi_loader: fix image and load_options leak on FDT load failure

[Ilias Apalodimas]

On Fri, 23 Oct 2026 at 00:44, Yuho Choi <oss.patchbox@gmail.com> wrote:
>
> When efi_bootmgr_run() attempts to load an FDT specified in the active
> Boot#### option on non-ACPI platforms, load_fdt_from_load_option() may
> fail (e.g. if the file is missing or unreadable).
>
> In this failure path, efi_bootmgr_run() returns the error code immediately,
> skipping the cleanup code at the end of the function. This leaks the loaded
> image handle, allocated memory pages, loaded image protocol, and the
> malloc'd load_options buffer.
>
> Fix this by jumping to the cleanup label 'out' so that efi_unload_image()
> and free(load_options) are called before returning.
>
> Fixes: 39bac24a48b0 ("efi_loader: load device-tree specified in boot option")

As Carlo pointed out, the SHA1 is probably from an internal tree;
39bac24a48bb is the right one

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
> ---
>  lib/efi_loader/efi_bootmgr.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/lib/efi_loader/efi_bootmgr.c b/lib/efi_loader/efi_bootmgr.c
> index 51ecb6ec1f..934f0c4060 100644
> --- a/lib/efi_loader/efi_bootmgr.c
> +++ b/lib/efi_loader/efi_bootmgr.c
> @@ -1323,7 +1323,7 @@ efi_status_t efi_bootmgr_run(void *fdt)
>                 if (!fdt) {
>                         ret = load_fdt_from_load_option(&fdt_lo);
>                         if (ret != EFI_SUCCESS)
> -                               return ret;
> +                               goto out;
>                         if (fdt_lo)
>                                 fdt = fdt_lo;
>                 }
> @@ -1339,6 +1339,7 @@ efi_status_t efi_bootmgr_run(void *fdt)
>          */
>         ret = efi_install_fdt(fdt);
>
> +out:
>         if (!IS_ENABLED(CONFIG_GENERATE_ACPI_TABLE)) {
>                 free(fdt_lo);
>                 if (fdt_distro)
> --
> 2.43.0
>