[PATCH master 1/2] FIT: fix double free issue with >1 reference count

[PATCH master 1/2] FIT: fix double free issue with >1 reference count

[Ahmad Fatoum]

fit_open() was recently changed to be reference counted. When the FIT is
already open, a handle will be returned with the canonical filename
being the only allocation incurred.

fit_close() however unconditionally frees the handle without regards to
the reference count.

Fix this and while at it, fix the memory leak for the canonical filename
as well.

Reported-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Fixes: f3aadb274abe ("FIT: add support to cache opened fit images")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/image-fit.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/common/image-fit.c b/common/image-fit.c
index d8fa5a4c8a8b..b5d0e2e5381f 100644
--- a/common/image-fit.c
+++ b/common/image-fit.c
@@ -1020,6 +1020,7 @@ struct fit_handle *fit_open(const char *_filename, bool verbose,
 
 	handle = fit_get_handle(filename);
 	if (handle) {
+		free(filename);
 		refcount_inc(&handle->users);
 		return handle;
 	}
@@ -1053,10 +1054,10 @@ struct fit_handle *fit_open(const char *_filename, bool verbose,
 	return handle;
 }
 
-static void __fit_close(struct fit_handle *handle)
+static bool __fit_close(struct fit_handle *handle)
 {
 	if (!refcount_dec_and_test(&handle->users))
-		return;
+		return false;
 
 	if (handle->root)
 		of_delete_node(handle->root);
@@ -1066,12 +1067,13 @@ static void __fit_close(struct fit_handle *handle)
 
 	free(handle->filename);
 	free(handle->fit_alloc);
+	return true;
 }
 
 void fit_close(struct fit_handle *handle)
 {
-	__fit_close(handle);
-	free(handle);
+	if (__fit_close(handle))
+		free(handle);
 }
 
 static int do_bootm_fit(struct image_data *data)
-- 
2.47.3

[PATCH master 2/2] FIT: fuzz: fix reference count underflow

[Ahmad Fatoum]

Now that FIT images are reference counted, we need to initialize the
count to 1, otherwise __fit_close will underflow it.

Reported-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Fixes: f3aadb274abe ("FIT: add support to cache opened fit images")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
Issue was found by Claude while reviewing the previous patch
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/image-fit.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/common/image-fit.c b/common/image-fit.c
index b5d0e2e5381f..26bd8e265b25 100644
--- a/common/image-fit.c
+++ b/common/image-fit.c
@@ -1120,6 +1120,8 @@ static int fuzz_fit(const u8 *data, size_t size)
 	handle.fit = data;
 	handle.fit_alloc = NULL;
 
+	refcount_set(&handle.users, 1);
+
 	ret = fit_do_open(&handle);
 	if (ret)
 		goto out;
-- 
2.47.3

Re: [PATCH master 1/2] FIT: fix double free issue with >1 reference count

[Marco Felsch]

On 26-01-26, Ahmad Fatoum wrote:
> fit_open() was recently changed to be reference counted. When the FIT is
> already open, a handle will be returned with the canonical filename
> being the only allocation incurred.
> 
> fit_close() however unconditionally frees the handle without regards to
> the reference count.
> 
> Fix this and while at it, fix the memory leak for the canonical filename
> as well.
> 
> Reported-by: Claude Sonnet 4.5 <noreply@anthropic.com>
> Fixes: f3aadb274abe ("FIT: add support to cache opened fit images")
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>

Re: [PATCH master 1/2] FIT: fix double free issue with >1 reference count

[Sascha Hauer]

On Mon, 26 Jan 2026 11:44:29 +0100, Ahmad Fatoum wrote:
> fit_open() was recently changed to be reference counted. When the FIT is
> already open, a handle will be returned with the canonical filename
> being the only allocation incurred.
> 
> fit_close() however unconditionally frees the handle without regards to
> the reference count.
> 
> [...]

Applied, thanks!

[1/2] FIT: fix double free issue with >1 reference count
      https://git.pengutronix.de/cgit/barebox/commit/?id=ba345a71e85e (link may not be stable)
[2/2] FIT: fuzz: fix reference count underflow
      https://git.pengutronix.de/cgit/barebox/commit/?id=e400bf88dea6 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>