[PATCH v2] efi_loader: fix image and load_options leak on FDT load failure

[PATCH v2] efi_loader: fix image and load_options leak on FDT load failure

[Yuho Choi]

When efi_bootmgr_run() attempts to load an FDT specified in the active
Boot#### option on non-ACPI platforms, load_fdt_from_load_option() may
fail (e.g. if the file is missing or unreadable).

In this failure path, efi_bootmgr_run() returns the error code immediately,
skipping the cleanup code at the end of the function. This leaks the loaded
image handle, allocated memory pages, loaded image protocol, and the
malloc'd load_options buffer.

Fix this by jumping to the cleanup label 'out' so that efi_unload_image()
and free(load_options) are called before returning.

Fixes: 39bac24a48bb ("efi_loader: load device-tree specified in boot option")
Reviewed-by: Carlo Caione <ccaione@baylibre.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
---
Changes in v2:
- Correct the abbreviated SHA in the Fixes tag (Carlo, Ilias)
- Collect Reviewed-by tags
- No code change; rebased on current master

 lib/efi_loader/efi_bootmgr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/efi_loader/efi_bootmgr.c b/lib/efi_loader/efi_bootmgr.c
index 6b5dad21b06..536b58f95e8 100644
--- a/lib/efi_loader/efi_bootmgr.c
+++ b/lib/efi_loader/efi_bootmgr.c
@@ -1323,7 +1323,7 @@ efi_status_t efi_bootmgr_run(void *fdt)
 		if (!fdt) {
 			ret = load_fdt_from_load_option(&fdt_lo);
 			if (ret != EFI_SUCCESS)
-				return ret;
+				goto out;
 			if (fdt_lo)
 				fdt = fdt_lo;
 		}
@@ -1339,6 +1339,7 @@ efi_status_t efi_bootmgr_run(void *fdt)
 	 */
 	ret = efi_install_fdt(fdt);
 
+out:
 	if (!IS_ENABLED(CONFIG_GENERATE_ACPI_TABLE)) {
 		free(fdt_lo);
 		if (fdt_distro)
-- 
2.43.0