[PATCH 3/3] common/spl: improve error handling in spl_fit

Mikhail Kshevetskiy mikhail.kshevetskiy at iopsys.eu
Fri Jun 6 21:35:24 CEST 2025


This fix possible NULL pointer dereference.
Also some comments added about potential memory leak.

Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy at iopsys.eu>
---
 common/spl/spl_fit.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
index 783bb84bdb5..438d1ecf124 100644
--- a/common/spl/spl_fit.c
+++ b/common/spl/spl_fit.c
@@ -703,13 +703,29 @@ static int spl_simple_fit_read(struct spl_fit_info *ctx,
 	 */
 	size = get_aligned_image_size(info, size, 0);
 	buf = board_spl_fit_buffer_addr(size, size, 1);
+	if (!buf)
+		return -EIO;
 
 	count = info->read(info, offset, size, buf);
+	if (!count) {
+		/*
+		 * The memory allocated by board_spl_fit_buffer_addr()
+		 * should be freed. Unfortunately, we don't know what
+		 * memory allocation mechanism was used, so we'll hope
+		 * for the best and leave it as is.
+		 *
+		 * To somewhat reduce memory consumption, one can try
+		 * to reuse previously allocated memory as it's done in
+		 * board_spl_fit_buffer_addr() from test/image/spl_load.c
+		 */
+		return -EIO;
+	}
+
 	ctx->fit = buf;
 	debug("fit read offset %lx, size=%lu, dst=%p, count=%lu\n",
 	      offset, size, buf, count);
 
-	return (count == 0) ? -EIO : 0;
+	return 0;
 }
 
 static int spl_simple_fit_parse(struct spl_fit_info *ctx)
-- 
2.47.2



More information about the U-Boot mailing list