From 03de305ec48b0bb28554372abb40ccd46dbe0bf9 Mon Sep 17 00:00:00 2001 From: Tom Rini Date: Mon, 20 May 2024 13:35:03 -0600 Subject: Restore patch series "arm: dts: am62-beagleplay: Fix Beagleplay Ethernet" As part of bringing the master branch back in to next, we need to allow for all of these changes to exist here. Reported-by: Jonas Karlman Signed-off-by: Tom Rini --- cmd/gpt.c | 1 - 1 file changed, 1 deletion(-) (limited to 'cmd/gpt.c') diff --git a/cmd/gpt.c b/cmd/gpt.c index 7aaf1889a5a..36b112d5978 100644 --- a/cmd/gpt.c +++ b/cmd/gpt.c @@ -10,7 +10,6 @@ * author: Piotr Wilczek */ -#include #include #include #include -- cgit v1.2.3 From 04c63f134cf268532f6e499aa2edb4f6f45ecefb Mon Sep 17 00:00:00 2001 From: Sam Protsenko Date: Wed, 19 Jun 2024 16:23:30 -0500 Subject: cmd: gpt: Fix freeing gpt_pte in gpt_verify() In case when either gpt_verify_headers() or gpt_verify_partitions() fails, the memory allocated for gpt_pte will be freed in those functions internally, but gpt_pte will still contain non-NULL dangling pointer. The attempt to free it in those cases in gpt_verify() leads to "use after free" error, which leads to a "Synchronous abort" exception. This issue was found by running the next command on the device with incorrect partition table: => gpt verify mmc 0 $partitions which results to: No partition list provided - only basic check "Synchronous Abort" handler, esr 0x96000021, far 0xba247bff .... Fix the issue by only freeing gpt_pte if none of those functions failed. Fixes: bbb9ffac6066 ("gpt: command: Extend gpt command to support GPT table verification") Signed-off-by: Sam Protsenko --- cmd/gpt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'cmd/gpt.c') diff --git a/cmd/gpt.c b/cmd/gpt.c index 36b112d5978..aeabd19dd76 100644 --- a/cmd/gpt.c +++ b/cmd/gpt.c @@ -682,7 +682,8 @@ static int gpt_verify(struct blk_desc *blk_dev_desc, const char *str_part) free(str_disk_guid); free(partitions); out: - free(gpt_pte); + if (!ret) + free(gpt_pte); return ret; } -- cgit v1.2.3