[PATCH] bootstd: android: avoid possible null pointer dereference

[PATCH] bootstd: android: avoid possible null pointer dereference

[Gary Bisson]

- avb_slot_verify_data_free() doesn't check its data parameter
- out_data can be null if avb_slot_verify() fails to allocate memory

Signed-off-by: Gary Bisson <bisson.gary@gmail.com>
---
Another approach would be to fix avb_slot_verify_data_free() to check
its paramter but I believe the goal is not to touch libavb to be closer
to upstream.
---
 boot/bootmeth_android.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c
index 3a59a4e3f6..f431b6ae58 100644
--- a/boot/bootmeth_android.c
+++ b/boot/bootmeth_android.c
@@ -481,7 +481,8 @@ static int run_avb_verification(struct bootflow *bflow)
 		if (result != AVB_SLOT_VERIFY_RESULT_OK) {
 			printf("Verification failed, reason: %s\n",
 			       str_avb_slot_error(result));
-			avb_slot_verify_data_free(out_data);
+			if (out_data)
+				avb_slot_verify_data_free(out_data);
 			return log_msg_ret("avb verify", -EIO);
 		}
 		boot_state = AVB_GREEN;
@@ -491,7 +492,8 @@ static int run_avb_verification(struct bootflow *bflow)
 		    result != AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION) {
 			printf("Unlocked verification failed, reason: %s\n",
 			       str_avb_slot_error(result));
-			avb_slot_verify_data_free(out_data);
+			if (out_data)
+				avb_slot_verify_data_free(out_data);
 			return log_msg_ret("avb verify unlocked", -EIO);
 		}
 		boot_state = AVB_ORANGE;
-- 
2.47.2

Re: [PATCH] bootstd: android: avoid possible null pointer dereference

[Mattijs Korpershoek]

Hi Gary,

Thank you for the patch.

On mer., avril 02, 2025 at 16:42, Gary Bisson <bisson.gary@gmail.com> wrote:

> - avb_slot_verify_data_free() doesn't check its data parameter
> - out_data can be null if avb_slot_verify() fails to allocate memory
>
> Signed-off-by: Gary Bisson <bisson.gary@gmail.com>

Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

> ---
> Another approach would be to fix avb_slot_verify_data_free() to check
> its paramter but I believe the goal is not to touch libavb to be closer
> to upstream.
> ---
>  boot/bootmeth_android.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c
> index 3a59a4e3f6..f431b6ae58 100644
> --- a/boot/bootmeth_android.c
> +++ b/boot/bootmeth_android.c
> @@ -481,7 +481,8 @@ static int run_avb_verification(struct bootflow *bflow)
>  		if (result != AVB_SLOT_VERIFY_RESULT_OK) {
>  			printf("Verification failed, reason: %s\n",
>  			       str_avb_slot_error(result));
> -			avb_slot_verify_data_free(out_data);
> +			if (out_data)
> +				avb_slot_verify_data_free(out_data);
>  			return log_msg_ret("avb verify", -EIO);
>  		}
>  		boot_state = AVB_GREEN;
> @@ -491,7 +492,8 @@ static int run_avb_verification(struct bootflow *bflow)
>  		    result != AVB_SLOT_VERIFY_RESULT_ERROR_VERIFICATION) {
>  			printf("Unlocked verification failed, reason: %s\n",
>  			       str_avb_slot_error(result));
> -			avb_slot_verify_data_free(out_data);
> +			if (out_data)
> +				avb_slot_verify_data_free(out_data);
>  			return log_msg_ret("avb verify unlocked", -EIO);
>  		}
>  		boot_state = AVB_ORANGE;
> -- 
> 2.47.2

Re: [PATCH] bootstd: android: avoid possible null pointer dereference

[Mattijs Korpershoek]

Hi,

On Wed, 02 Apr 2025 16:42:19 +0200, Gary Bisson wrote:
> - avb_slot_verify_data_free() doesn't check its data parameter
> - out_data can be null if avb_slot_verify() fails to allocate memory
> 
> 

Thanks, Applied to https://source.denx.de/u-boot/custodians/u-boot-dfu (u-boot-dfu)

[1/1] bootstd: android: avoid possible null pointer dereference
      https://source.denx.de/u-boot/custodians/u-boot-dfu/-/commit/df50c821e75957113b93e45b363cb22c965e7a9b

--
Mattijs