[PATCH] efi_loader: fix use after free in efi_exit() with tcg2

[Vincent Stehlé]

The efi_exit() function frees the loaded image memory by calling
efi_delete_image(). However, when CONFIG_EFI_TCG2_PROTOCOL is enabled, the
image_obj->image_type structure member is accessed after the memory has
been freed.

Fix this by keeping a copy of image_type, as is already done for exit_jmp.

Fixes: 8fc4e0b4273a ("efi_loader: add boot variable measurement")
Signed-off-by: Vincent Stehlé <vincent.stehle at arm.com>
Cc: Heinrich Schuchardt <xypron.glpk at gmx.de>
Cc: Ilias Apalodimas <ilias.apalodimas at linaro.org>
Cc: Tom Rini <trini at konsulko.com>
Cc: Masahisa Kojima <masahisa.kojima at linaro.org>
---

Hi,

This can be verified with sandbox_defconfig + CONFIG_VALGRIND=y and the
following command:

  valgrind --suppressions=scripts/u-boot.supp \
    ./u-boot -T -c "setenv efi_selftest start image return; \
                    bootefi selftest"

Best regards,
Vincent.

 lib/efi_loader/efi_boottime.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c
index ddc935d2240..0b3f2fd276c 100644
--- a/lib/efi_loader/efi_boottime.c
+++ b/lib/efi_loader/efi_boottime.c
@@ -3453,6 +3453,7 @@ static efi_status_t EFIAPI efi_exit(efi_handle_t image_handle,
 	struct efi_loaded_image_obj *image_obj =
 		(struct efi_loaded_image_obj *)image_handle;
 	jmp_buf *exit_jmp;
+	u16 image_type;
 
 	EFI_ENTRY("%p, %ld, %zu, %p", image_handle, exit_status,
 		  exit_data_size, exit_data);
@@ -3496,13 +3497,14 @@ static efi_status_t EFIAPI efi_exit(efi_handle_t image_handle,
 	}
 	/* efi_delete_image() frees image_obj. Copy before the call. */
 	exit_jmp = image_obj->exit_jmp;
+	image_type = image_obj->image_type;
 	*image_obj->exit_status = exit_status;
-	if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION ||
+	if (image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION ||
 	    exit_status != EFI_SUCCESS)
 		efi_delete_image(image_obj, loaded_image_protocol);
 
 	if (IS_ENABLED(CONFIG_EFI_TCG2_PROTOCOL)) {
-		if (image_obj->image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) {
+		if (image_type == IMAGE_SUBSYSTEM_EFI_APPLICATION) {
 			ret = efi_tcg2_measure_efi_app_exit();
 			if (ret != EFI_SUCCESS)
 				log_debug("tcg2 measurement fails (0x%lx)\n",
-- 
2.51.0