efi_selftest: fix use-after-free

When the `memory' efi selftest verifies the Devicetree memory reservation,
it accesses the memory_map buffer after it has been freed with free_pool().
Move the verification earlier to fix this.

Fixes: 34c96659ed57 ("efi_selftest: check fdt is marked as runtime data")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Tom Rini <trini@konsulko.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

diff --git a/lib/efi_selftest/efi_selftest_memory.c b/lib/efi_selftest/efi_selftest_memory.c
index 7320964c129e93d8f873255ac268bde08b34a8bc..450470ceedda5aed97d2f3895a99e060c8fe1e01 100644 (file)
--- a/lib/efi_selftest/efi_selftest_memory.c
+++ b/lib/efi_selftest/efi_selftest_memory.c
@@ -155,6 +155,15 @@ static int execute(void)
                               EFI_RUNTIME_SERVICES_DATA) != EFI_ST_SUCCESS)
                return EFI_ST_FAILURE;
 
+       /* Check memory reservation for the device tree */
+       if (fdt_addr &&
+           find_in_memory_map(map_size, memory_map, desc_size, fdt_addr,
+                              EFI_ACPI_RECLAIM_MEMORY) != EFI_ST_SUCCESS) {
+               efi_st_error
+                       ("Device tree not marked as ACPI reclaim memory\n");
+               return EFI_ST_FAILURE;
+       }
+
        /* Free memory */
        ret = boottime->free_pages(p1, EFI_ST_NUM_PAGES);
        if (ret != EFI_SUCCESS) {
@@ -172,14 +181,6 @@ static int execute(void)
                return EFI_ST_FAILURE;
        }
 
-       /* Check memory reservation for the device tree */
-       if (fdt_addr &&
-           find_in_memory_map(map_size, memory_map, desc_size, fdt_addr,
-                              EFI_ACPI_RECLAIM_MEMORY) != EFI_ST_SUCCESS) {
-               efi_st_error
-                       ("Device tree not marked as ACPI reclaim memory\n");
-               return EFI_ST_FAILURE;
-       }
        return EFI_ST_SUCCESS;
 }