From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Fri, 26 Jun 2026 21:17:28 +0000 (+0100)
Subject: boot: restore parent loaded image when initrd registration fails
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=baad1744bd0bd4302ee438c7f1ba60217e758199;p=thirdparty%2Fsystemd.git

boot: restore parent loaded image when initrd registration fails

linux_exec() patches the stub's own EFI_LOADED_IMAGE_PROTOCOL to point
at the loaded inner kernel, and restores the saved original only after
the entry point returns. The initrd_register() failure path returns
without restoring, leaving the firmware's protocol pointing to freed
data.

Follow-up for f4051650657cd337ceba67b773f0e3bf854cbaff
---

diff --git a/src/boot/linux.c b/src/boot/linux.c
index 56b932ecb56..67ed8599931 100644
--- a/src/boot/linux.c
+++ b/src/boot/linux.c
@@ -355,8 +355,12 @@ EFI_STATUS linux_exec(
 
         _cleanup_(cleanup_initrd) EFI_HANDLE initrd_handle = NULL;
         err = initrd_register(initrd, &initrd_handle);
-        if (err != EFI_SUCCESS)
+        if (err != EFI_SUCCESS) {
+                /* Restore the patched fields before kernel_file_path and loaded_kernel_pages are freed,
+                 * otherwise the stub's own EFI_LOADED_IMAGE_PROTOCOL is left pointing at freed memory. */
+                *parent_loaded_image = original_parent_loaded_image;
                 return log_error_status(err, "Error registering initrd: %m");
+        }
 
         log_wait();