[PATCH] efi_loader: unload image on security violation in efi_run_image()

[PATCH] efi_loader: unload image on security violation in efi_run_image()

[Yuho Choi]

efi_load_image() returns EFI_SECURITY_VIOLATION when an image fails
Secure Boot authentication. In that case the image has still been
loaded and a valid image handle is returned, and it is up to the caller
to unload it.

efi_run_image() treats this like any other load failure and returns
without calling efi_unload_image(). With CONFIG_EFI_SECURE_BOOT=y and
Secure Boot enforced, each attempt to run an image that is not
authorized through 'bootefi', 'bootm' or an EFI bootflow therefore
leaves the relocated image pages, the image handle and its loaded image
protocol behind.

Unload the image on EFI_SECURITY_VIOLATION, as try_load_entry() already
does for boot options.

Fixes: 4540dabdcaca ("efi_loader: image_loader: support image authentication")
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Tested on sandbox only. With LTO disabled, gdb set efi_secure_boot to
true at the start of efi_load_image(), so that the unsigned
'bootefi hello' image failed authentication. Without this patch each
attempt left one more handle with a Loaded Image protocol in
'efidebug dh' (5, 6, 7 handles); with it the count stays at 5. A normal
'bootefi hello' still runs. Not tested with enrolled keys or on
hardware.

 lib/efi_loader/efi_bootbin.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/efi_loader/efi_bootbin.c b/lib/efi_loader/efi_bootbin.c
index 12db8f517c7..752400c0eea 100644
--- a/lib/efi_loader/efi_bootbin.c
+++ b/lib/efi_loader/efi_bootbin.c
@@ -184,6 +184,10 @@ static efi_status_t efi_run_image(void *source_buffer, efi_uintn_t source_size,
 				      source_size, &handle));
 	if (ret != EFI_SUCCESS) {
 		log_err("Loading image failed\n");
+		/* On a security violation the image is loaded but not started */
+		if (ret == EFI_SECURITY_VIOLATION &&
+		    EFI_CALL(efi_unload_image(handle)) != EFI_SUCCESS)
+			log_err("Unloading image failed\n");
 		goto out;
 	}
 
-- 
2.43.0

Re: [PATCH] efi_loader: unload image on security violation in efi_run_image()

[Heinrich Schuchardt]

On 11/2/26 05:10, Yuho Choi wrote:
> efi_load_image() returns EFI_SECURITY_VIOLATION when an image fails
> Secure Boot authentication. In that case the image has still been
> loaded and a valid image handle is returned, and it is up to the caller
> to unload it.
> 
> efi_run_image() treats this like any other load failure and returns
> without calling efi_unload_image(). With CONFIG_EFI_SECURE_BOOT=y and
> Secure Boot enforced, each attempt to run an image that is not
> authorized through 'bootefi', 'bootm' or an EFI bootflow therefore
> leaves the relocated image pages, the image handle and its loaded image
> protocol behind.
> 
> Unload the image on EFI_SECURITY_VIOLATION, as try_load_entry() already
> does for boot options.
> 
> Fixes: 4540dabdcaca ("efi_loader: image_loader: support image authentication")
> Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
> ---
> Tested on sandbox only. With LTO disabled, gdb set efi_secure_boot to
> true at the start of efi_load_image(), so that the unsigned
> 'bootefi hello' image failed authentication. Without this patch each
> attempt left one more handle with a Loaded Image protocol in
> 'efidebug dh' (5, 6, 7 handles); with it the count stays at 5. A normal
> 'bootefi hello' still runs. Not tested with enrolled keys or on
> hardware.
> 
>   lib/efi_loader/efi_bootbin.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/lib/efi_loader/efi_bootbin.c b/lib/efi_loader/efi_bootbin.c
> index 12db8f517c7..752400c0eea 100644
> --- a/lib/efi_loader/efi_bootbin.c
> +++ b/lib/efi_loader/efi_bootbin.c
> @@ -184,6 +184,10 @@ static efi_status_t efi_run_image(void *source_buffer, efi_uintn_t source_size,
>   				      source_size, &handle));
>   	if (ret != EFI_SUCCESS) {
>   		log_err("Loading image failed\n");
> +		/* On a security violation the image is loaded but not started */
> +		if (ret == EFI_SECURITY_VIOLATION &&

Hello Yuho,

Thank you for looking into this resource leak.

Why would you only unload the image on a security violation and not on 
other errors inhibiting launching an image?

Best regards

Heinrich

> +		    EFI_CALL(efi_unload_image(handle)) != EFI_SUCCESS)
> +			log_err("Unloading image failed\n");
>   		goto out;
>   	}
>   

Re: [PATCH] efi_loader: unload image on security violation in efi_run_image()

[Yuho Choi]

On Tue, 3 Nov 2026 at 03:39, Heinrich Schuchardt <xypron.glpk@gmx.de> wrote:
>
> Why would you only unload the image on a security violation and not on
> other errors inhibiting launching an image?

Thanks for the review! efi_run_image() also leaks the image when
efi_env_set_load_options() fails. I will send a v2 that unloads the
image on any error before it is started, unless you disagree.

Thanks,
Yuho