[PATCH] fs: efi: don't leak the file info buffer in efifs_truncate()

[PATCH] fs: efi: don't leak the file info buffer in efifs_truncate()

[Ahmad Fatoum]

The 1 KiB EFI_FILE_INFO buffer is never freed on any of the three
exits, and this runs on every truncating open.

Assisted-by: Claude:opus-5
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 fs/efi.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/efi.c b/fs/efi.c
index 76eb86a85eea..74dad235b19d 100644
--- a/fs/efi.c
+++ b/fs/efi.c
@@ -250,9 +250,9 @@ static int efifs_truncate(struct file *f, loff_t size)
 	efi_status_t efiret;
 	struct efi_file_info *info;
 	size_t bufsize = 1024;
-	int ret;
+	int ret = 0;
 
-	info = xzalloc(1024);
+	info = xzalloc(bufsize);
 
 	efiret = ufile->entry->get_info(ufile->entry, &efi_file_info_id, &bufsize, info);
 	if (EFI_ERROR(efiret)) {
@@ -262,7 +262,7 @@ static int efifs_truncate(struct file *f, loff_t size)
 	}
 
 	if (size > info->FileSize)
-		return 0;
+		goto out;
 
 	info->FileSize = size;
 
@@ -270,11 +270,11 @@ static int efifs_truncate(struct file *f, loff_t size)
 	if (EFI_ERROR(efiret)) {
 		pr_err("%s: unable to SetInfo: %s\n", __func__, efi_strerror(efiret));
 		ret = -efi_errno(efiret);
-		goto out;
 	}
 
-	return 0;
 out:
+	free(info);
+
 	return ret;
 }
 
-- 
2.47.3

Re: [PATCH] fs: efi: don't leak the file info buffer in efifs_truncate()

[Sascha Hauer]

On Fri, 04 Sep 2026 09:16:21 +0200, Ahmad Fatoum wrote:
> The 1 KiB EFI_FILE_INFO buffer is never freed on any of the three
> exits, and this runs on every truncating open.
> 
> 

Applied, thanks!

[1/1] fs: efi: don't leak the file info buffer in efifs_truncate()
      https://git.pengutronix.de/cgit/barebox/commit/?id=e55bbfa26b2a (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>