[PATCH master] bootm: fix bootm override saving/restoring

[PATCH master] bootm: fix bootm override saving/restoring

[Ahmad Fatoum]

As bootm_set_overrides() only sets non-NULL members, it's not suitable
to restore old settings as once a member is non-NULL, it can't change
it.

This may lead to use-after-frees, as the original strings are free'd,
but the override keeps pointing at it.
Fix this by merging overrides only before the boot and resetting all
members after.

Fixes: d2dae53f0dc5 ("bootm: fix boot override inheritance")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/boot.c             | 4 ++--
 common/bootm.c            | 6 +++++-
 include/bootm-overrides.h | 6 ++++--
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/common/boot.c b/common/boot.c
index e400a4fcb8b3..af07d218f059 100644
--- a/common/boot.c
+++ b/common/boot.c
@@ -174,13 +174,13 @@ int boot_entry(struct bootentry *be, int verbose, int dryrun)
 		}
 	}
 
-	old = bootm_set_overrides(be->overrides);
+	old = bootm_save_overrides(be->overrides);
 
 	ret = be->boot(be, verbose, dryrun);
 	if (ret && ret != -ENOMEDIUM)
 		pr_err("Booting entry '%s' failed: %pe\n", be->title, ERR_PTR(ret));
 
-	bootm_set_overrides(old);
+	bootm_restore_overrides(old);
 
 	globalvar_set_match("linux.bootargs.dyn.", "");
 
diff --git a/common/bootm.c b/common/bootm.c
index f05a4b1b1f42..35305f25375a 100644
--- a/common/bootm.c
+++ b/common/bootm.c
@@ -778,13 +778,17 @@ int bootm_boot(struct bootm_data *bootm_data)
 }
 
 #ifdef CONFIG_BOOT_OVERRIDE
-struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides)
+struct bootm_overrides bootm_save_overrides(const struct bootm_overrides overrides)
 {
 	struct bootm_overrides old = bootm_overrides;
 	/* bootm_merge_overrides copies only actual (non-NULL) overrides */
 	bootm_merge_overrides(&bootm_overrides, &overrides);
 	return old;
 }
+void bootm_restore_overrides(const struct bootm_overrides overrides)
+{
+	bootm_overrides = overrides;
+}
 #endif
 
 bool bootm_efi_check_image(struct image_handler *handler,
diff --git a/include/bootm-overrides.h b/include/bootm-overrides.h
index 4a270b95afcc..b807e5be310a 100644
--- a/include/bootm-overrides.h
+++ b/include/bootm-overrides.h
@@ -8,12 +8,14 @@ struct bootm_overrides {
 };
 
 #ifdef CONFIG_BOOT_OVERRIDE
-struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides_new);
+struct bootm_overrides bootm_save_overrides(const struct bootm_overrides overrides);
+void bootm_restore_overrides(const struct bootm_overrides overrides);
 #else
-static inline struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides)
+static inline struct bootm_overrides bootm_save_overrides(const struct bootm_overrides overrides)
 {
 	return (struct bootm_overrides) {};
 }
+static inline void bootm_restore_overrides(const struct bootm_overrides overrides) {}
 #endif
 
 static inline void bootm_merge_overrides(struct bootm_overrides *dst,
-- 
2.47.3

Re: [PATCH master] bootm: fix bootm override saving/restoring

[Sascha Hauer]

On Mon, 26 Jan 2026 11:46:44 +0100, Ahmad Fatoum wrote:
> As bootm_set_overrides() only sets non-NULL members, it's not suitable
> to restore old settings as once a member is non-NULL, it can't change
> it.
> 
> This may lead to use-after-frees, as the original strings are free'd,
> but the override keeps pointing at it.
> Fix this by merging overrides only before the boot and resetting all
> members after.
> 
> [...]

Applied, thanks!

[1/1] bootm: fix bootm override saving/restoring
      https://git.pengutronix.de/cgit/barebox/commit/?id=e0b19f3ac155 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>