From 2dca5d193f9e082fe593cf0ab312c24bbab9072f Mon Sep 17 00:00:00 2001 From: Alexander Egorenkov Date: Fri, 27 Nov 2020 07:59:13 +0100 Subject: [PATCH] zipl/boot: fix memory use after free in stage2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prevent access to freed memory still pointed to by entry. entry still points into load_page that has been released with free_page. Signed-off-by: Alexander Egorenkov Reviewed-by: Marc Hartmayer Signed-off-by: Jan Höppner --- zipl/boot/stage2.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/zipl/boot/stage2.c b/zipl/boot/stage2.c index 78591c1a..2353baf5 100644 --- a/zipl/boot/stage2.c +++ b/zipl/boot/stage2.c @@ -90,6 +90,7 @@ void start(void) void *load_address; struct component_entry *entry; disk_blockptr_t *blockptr; + uint64_t load_psw; void *load_page; int config_nr; @@ -133,11 +134,13 @@ void start(void) if (entry->type != COMPONENT_EXECUTE) panic(EWRONGTYPE, ""); + load_psw = entry->address.load_psw; + free_page((unsigned long)load_page); io_irq_disable(); set_device(subchannel_id, DISABLED); - execute(entry->address.load_psw); + execute(load_psw); } void panic_notify(unsigned long UNUSED(reason))