From 4563f9c1476bfc9d8a4e618797499a696e82bf20 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 19 May 2026 13:39:09 +0200 Subject: [PATCH] EFI: adjust cfg file buffer freeing The boot services FreePages() needs passing the size. Since we allocated one more byte to put a trailing nul there, we also need to bump the size passed there. Make a small helper function to centralize this. Note that there's no permanent memory leak because of the oversight: The allocation is done using EfiLoaderData, and all memory of that type is later reclaimed anyway. Fixes: df75f77092c1 ("EFI: avoid OOB config file reads") Reported-by: Bernhard Kaindl Signed-off-by: Jan Beulich Reviewed-by: Bernhard Kaindl Acked-by: Daniel P. Smith master commit: 4ff927133ebc32498fd4af49a8025a846cfe1dc6 master date: 2026-05-06 15:11:11 +0200 --- xen/common/efi/boot.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/xen/common/efi/boot.c b/xen/common/efi/boot.c index c2db9afd63..5082a23a7f 100644 --- a/xen/common/efi/boot.c +++ b/xen/common/efi/boot.c @@ -702,6 +702,16 @@ static void __init efi_relocate_esrt(EFI_SYSTEM_TABLE *SystemTable) */ #include "efi-boot.h" +static void __init free_cfg(void) +{ + if ( !cfg.need_to_free ) + return; + + /* One extra byte was allocated to put a nul character there. */ + efi_bs->FreePages(cfg.addr, PFN_UP(cfg.size + 1)); + cfg.need_to_free = false; +} + void __init noreturn blexit(const CHAR16 *str) { if ( str ) @@ -711,8 +721,7 @@ void __init noreturn blexit(const CHAR16 *str) if ( !efi_bs ) efi_arch_halt(); - if ( cfg.need_to_free ) - efi_bs->FreePages(cfg.addr, PFN_UP(cfg.size)); + free_cfg(); if ( kernel.need_to_free ) efi_bs->FreePages(kernel.addr, PFN_UP(kernel.size)); if ( ramdisk.need_to_free ) @@ -1435,11 +1444,7 @@ void EFIAPI __init noreturn efi_start(EFI_HANDLE ImageHandle, name.s = get_value(&cfg, "global", "chain"); if ( !name.s ) break; - if ( cfg.need_to_free ) - { - efi_bs->FreePages(cfg.addr, PFN_UP(cfg.size)); - cfg.need_to_free = false; - } + free_cfg(); if ( !read_file(dir_handle, s2w(&name), &cfg, NULL) ) { PrintStr(L"Chained configuration file '"); @@ -1504,11 +1509,7 @@ void EFIAPI __init noreturn efi_start(EFI_HANDLE ImageHandle, efi_arch_cfg_file_late(loaded_image, dir_handle, section.s); - if ( cfg.need_to_free ) - { - efi_bs->FreePages(cfg.addr, PFN_UP(cfg.size)); - cfg.need_to_free = false; - } + free_cfg(); dir_handle->Close(dir_handle);