From: Mattijs Korpershoek <mkorpershoek@kernel.org>
To: Igor Opaniuk <igor.opaniuk@gmail.com>, u-boot@lists.denx.de
Cc: Simon Glass <sjg@chromium.org>, Tom Rini <trini@konsulko.com>,
"Guillaume La Roque (TI.com)" <glaroque@baylibre.com>,
"Nicolas Belin (TI.com)" <nbelin@baylibre.com>,
Francois Berder <fberder@outlook.fr>,
Sam Protsenko <semen.protsenko@linaro.org>,
Igor Opaniuk <igor.opaniuk@gmail.com>
Subject: Re: [PATCH 1/2] boot: android: fix AvbOps and verify-data leaks in AVB path
Date: Thu, 23 Jul 2026 14:48:03 +0200 [thread overview]
Message-ID: <87bjbx98jg.fsf@kernel.org> (raw)
In-Reply-To: <20260712-avb-fix-memory-leaks-v1-1-51d6d5a42631@gmail.com>
Hi Igor,
Thank you for the patch.
On Sun, Jul 12, 2026 at 10:50, Igor Opaniuk <igor.opaniuk@gmail.com> wrote:
> run_avb_verification() allocates an AvbOps via avb_ops_alloc() but never
> frees it on any return path. Every Android boot attempt therefore leaks
> the AvbOpsData structure and, when CONFIG_OPTEE_TA_AVB is enabled, leaves
> the OP-TEE session open (it is only closed inside avb_ops_free()).
>
> In addition, the AvbSlotVerifyData returned by avb_slot_verify() is only
> released on the failure branches. The successful "return 0" paths (both
> the locked GREEN/OK case and the unlocked ORANGE/ERROR_VERIFICATION case)
> return without freeing it, leaking the whole out_data (cmdline and loaded
> partition metadata) on every good boot.
>
> Route all exit paths through a single cleanup label that frees both
> out_data and avb_ops.
>
> Fixes: 125d9f3306ea ("bootstd: Add a bootmeth for Android")
> Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Good catch. Thank you for this!
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
next prev parent reply other threads:[~2026-07-23 12:48 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-12 8:50 [PATCH 0/2] avb: fix memory leaks in AVB 2.0 verification path Igor Opaniuk
2026-07-12 8:50 ` [PATCH 1/2] boot: android: fix AvbOps and verify-data leaks in AVB path Igor Opaniuk
2026-07-23 12:48 ` Mattijs Korpershoek [this message]
2026-07-12 8:50 ` [PATCH 2/2] avb: free mmc_part allocated by get_partition() Igor Opaniuk
2026-07-23 12:53 ` Mattijs Korpershoek
2026-07-15 16:29 ` [PATCH 0/2] avb: fix memory leaks in AVB 2.0 verification path Igor Opaniuk
2026-07-21 8:28 ` Mattijs Korpershoek via U-Boot
2026-07-24 12:43 ` Mattijs Korpershoek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87bjbx98jg.fsf@kernel.org \
--to=mkorpershoek@kernel.org \
--cc=fberder@outlook.fr \
--cc=glaroque@baylibre.com \
--cc=igor.opaniuk@gmail.com \
--cc=nbelin@baylibre.com \
--cc=semen.protsenko@linaro.org \
--cc=sjg@chromium.org \
--cc=trini@konsulko.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.