boot: restore parent loaded image when initrd registration fails

linux_exec() patches the stub's own EFI_LOADED_IMAGE_PROTOCOL to point
at the loaded inner kernel, and restores the saved original only after
the entry point returns. The initrd_register() failure path returns
without restoring, leaving the firmware's protocol pointing to freed
data.

Follow-up for f4051650657cd337ceba67b773f0e3bf854cbaff

diff --git a/src/boot/linux.c b/src/boot/linux.c
index 56b932ecb563ddfd5bf10c4e609267178feea7ec..67ed8599931268730e612cf95533c1df08105fea 100644 (file)
--- a/src/boot/linux.c
+++ b/src/boot/linux.c
@@ -355,8 +355,12 @@ EFI_STATUS linux_exec(
 
         _cleanup_(cleanup_initrd) EFI_HANDLE initrd_handle = NULL;
         err = initrd_register(initrd, &initrd_handle);
-        if (err != EFI_SUCCESS)
+        if (err != EFI_SUCCESS) {
+                /* Restore the patched fields before kernel_file_path and loaded_kernel_pages are freed,
+                 * otherwise the stub's own EFI_LOADED_IMAGE_PROTOCOL is left pointing at freed memory. */
+                *parent_loaded_image = original_parent_loaded_image;
                 return log_error_status(err, "Error registering initrd: %m");
+        }
 
         log_wait();