From: Mattijs Korpershoek <mkorpershoek@kernel.org>
To: Igor Opaniuk <igor.opaniuk@gmail.com>, u-boot@lists.denx.de
Cc: Simon Glass <sjg@chromium.org>, Tom Rini <trini@konsulko.com>,
"Guillaume La Roque (TI.com)" <glaroque@baylibre.com>,
"Nicolas Belin (TI.com)" <nbelin@baylibre.com>,
Francois Berder <fberder@outlook.fr>,
Sam Protsenko <semen.protsenko@linaro.org>,
Igor Opaniuk <igor.opaniuk@gmail.com>
Subject: Re: [PATCH 1/2] boot: android: fix AvbOps and verify-data leaks in AVB path
Date: Thu, 23 Jul 2026 14:48:03 +0200 [thread overview]
Message-ID: <87bjbx98jg.fsf@kernel.org> (raw)
In-Reply-To: <20260712-avb-fix-memory-leaks-v1-1-51d6d5a42631@gmail.com>
Hi Igor,
Thank you for the patch.
On Sun, Jul 12, 2026 at 10:50, Igor Opaniuk <igor.opaniuk@gmail.com> wrote:
> run_avb_verification() allocates an AvbOps via avb_ops_alloc() but never
> frees it on any return path. Every Android boot attempt therefore leaks
> the AvbOpsData structure and, when CONFIG_OPTEE_TA_AVB is enabled, leaves
> the OP-TEE session open (it is only closed inside avb_ops_free()).
>
> In addition, the AvbSlotVerifyData returned by avb_slot_verify() is only
> released on the failure branches. The successful "return 0" paths (both
> the locked GREEN/OK case and the unlocked ORANGE/ERROR_VERIFICATION case)
> return without freeing it, leaking the whole out_data (cmdline and loaded
> partition metadata) on every good boot.
>
> Route all exit paths through a single cleanup label that frees both
> out_data and avb_ops.
>
> Fixes: 125d9f3306ea ("bootstd: Add a bootmeth for Android")
> Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Good catch. Thank you for this!
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
next prev parent reply other threads:[~2026-07-23 12:48 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-12 8:50 [PATCH 0/2] avb: fix memory leaks in AVB 2.0 verification path Igor Opaniuk
2026-07-12 8:50 ` [PATCH 1/2] boot: android: fix AvbOps and verify-data leaks in AVB path Igor Opaniuk
2026-07-23 12:48 ` Mattijs Korpershoek [this message]
2026-07-12 8:50 ` [PATCH 2/2] avb: free mmc_part allocated by get_partition() Igor Opaniuk
2026-07-23 12:53 ` Mattijs Korpershoek
2026-07-15 16:29 ` [PATCH 0/2] avb: fix memory leaks in AVB 2.0 verification path Igor Opaniuk
2026-07-21 8:28 ` Mattijs Korpershoek via U-Boot
2026-07-24 12:43 ` Mattijs Korpershoek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87bjbx98jg.fsf@kernel.org \
--to=mkorpershoek@kernel.org \
--cc=fberder@outlook.fr \
--cc=glaroque@baylibre.com \
--cc=igor.opaniuk@gmail.com \
--cc=nbelin@baylibre.com \
--cc=semen.protsenko@linaro.org \
--cc=sjg@chromium.org \
--cc=trini@konsulko.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox