diff mbox series

[v2,2/5] bios_emulator: don't free a caller-supplied BIOS image in biosemu_run

Message ID 20261003-aspeed_vbios_fixes-v2-2-f8e593f024ab@oss.tenstorrent.com
State New
Delegated to: Tom Rini
Headers show
Series [v2,1/5] bios_emulator: select X86EMU_RAW_IO only on x86 | expand

Commit Message

Anirudh Srinivasan Oct. 3, 2026, 8:07 p.m. UTC 
biosemu_run can be called with a BIOS image supplied by the caller
(argument bios_rom is not NULL), or with no image so that it makes its
own copy from the card's ROM (argument bios_rom is NULL).

It subsequently calls PCI_postController, where the BIOS image it runs
is stored in vga_info->BIOSImage. In the first case that pointer is the
caller's buffer; in the second it is a buffer biosemu_run itself
allocated.

The clean_up path in biosemu_run always frees vga_info->BIOSImage. That
is right for the second case, but in the first case it frees memory the
caller still owns. This can cause a double free when the caller tries
freeing this memory again.

Only free vga_info->BIOSImage when biosemu_run made the copy itself (i.e
bios_rom is NULL)

Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
---
 drivers/bios_emulator/atibios.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/bios_emulator/atibios.c b/drivers/bios_emulator/atibios.c
index e992a1aa822..ebeeb178b7f 100644
--- a/drivers/bios_emulator/atibios.c
+++ b/drivers/bios_emulator/atibios.c
@@ -509,7 +509,7 @@  int biosemu_run(struct udevice *pcidev, uchar *bios_rom, int bios_len,
 	*/
 	if (clean_up) {
 		BE_exit();
-		if (vga_info->BIOSImage &&
+		if (!bios_rom && vga_info->BIOSImage &&
 		    (ulong)(vga_info->BIOSImage) != 0xc0000)
 			free(vga_info->BIOSImage);
 		free(vga_info);