From beec6834544d8288d34ef0cd8e3c40aa890a8a10 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Vincent=20Stehl=C3=A9?= Date: Tue, 27 Jan 2026 17:18:43 +0100 Subject: [PATCH] efi_loader: fix use after free in efi_exit() with tcg2 MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit The efi_exit() function frees the loaded image memory by calling efi_delete_image(). However, when CONFIG_EFI_TCG2_PROTOCOL is enabled, the image_obj->image_type structure member is accessed after the memory has been freed. Fix this by performing the tcg2 measurement before the image deletion. Fixes: 8fc4e0b4273a ("efi_loader: add boot variable measurement") Suggested-by: Ilias Apalodimas Signed-off-by: Vincent Stehlé Cc: Heinrich Schuchardt Cc: Tom Rini Cc: Masahisa Kojima Acked-by: Masahisa Kojima Reviewed-by: Heinrich Schuchardt --- lib/efi_loader/efi_boottime.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index ddc935d2240..b424d924896 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -3494,12 +3494,6 @@ static efi_status_t EFIAPI efi_exit(efi_handle_t image_handle, if (ret != EFI_SUCCESS) EFI_PRINT("%s: out of memory\n", __func__); } - /* efi_delete_image() frees image_obj. Copy before the call. */ - exit_jmp = image_obj->exit_jmp; - *image_obj->exit_status = exit_status; - if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION || - exit_status != EFI_SUCCESS) - efi_delete_image(image_obj, loaded_image_protocol); if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) { if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) { @@ -3510,6 +3504,13 @@ static efi_status_t EFIAPI efi_exit(efi_handle_t image_handle, } } + /* efi_delete_image() frees image_obj. Copy before the call. */ + exit_jmp = image_obj->exit_jmp; + *image_obj->exit_status = exit_status; + if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION || + exit_status != EFI_SUCCESS) + efi_delete_image(image_obj, loaded_image_protocol); + /* Make sure entry/exit counts for EFI world cross-overs match */ EFI_EXIT(exit_status); -- 2.47.3