On 2026-10-18T04:23:45, Anirudh Srinivasan <[email protected]> wrote: > bios_emulator: Don't free a caller's BIOS image > > biosemu_run() can be called with a BIOS image supplied by the caller > (dm_pci_run_vga_bios() calls it with an image, so bios_rom is not NULL) > or with no image so that it makes its own copy from the card's ROM > (BootVideoCardBIOS() calls it with no image, so bios_rom is NULL). > > In the first case, the image is either at PCI_VGA_RAM_IMAGE_START > (0xc0000) on x86, or a buffer owned by the caller. In the second case, > the image is a buffer malloc()ed by PCI_postController() (which > biosemu_run() calls). The clean up path in biosemu_run() should only > free up the image in this case. > > However, the clean up path frees the image in both cases, which can > result in the freeing up a buffer owned by the caller in the first case > (dm_pci_run_vga_bios()). This can cause a double free when the caller > tries freeing up the buffer again. There is a currently a check to > prevent this from happen on x86 (vga_info->BIOSImage != 0xc0000), but > nothing stops this on other architectures. > > Update the clean up path to only free the image when biosemu_run() made > the copy itself (i.e. bios_rom is NULL). The existing checks for > vga_info->BIOSImage not being NULL or 0xc0000 can then be dropped, as > this copy is never at 0xc0000 and free(NULL) is safe. > > Fixes: 4c59f9532796 ("bios_emulator: Add vesa support and allow ROMs to be > passed in as data") > Signed-off-by: Anirudh Srinivasan <[email protected]> > > drivers/bios_emulator/atibios.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
