[PATCH 1/4] boot: fix use-after-free when restoring bootm variables

[Sascha Hauer <s.hauer@pengutronix.de>]

bootscript_boot() takes a backup of the global.bootm. variables with
bootm_data_init_defaults() to restore them after the boot script
returns. The string members of struct bootm_data are not copies, though:
getenv_nonempty() returns a pointer to the globalvar's current value.

When the boot script assigns one of these variables, the parameter code
frees the old value, leaving the backup pointing to freed memory, which
bootm_data_restore_defaults() then copies back. This is easily observed
with a boot script that sets global.bootm.image to a nonexistent file:
after the failed boot, global.bootm.image holds the script's value
instead of the original one, because the new value was allocated into
the just freed chunk.

Fix this by duplicating the strings in the backup and freeing them after
restoring.

Fixes: 926985a74ee0 ("bootm: don't clobber global.bootm. variables after script boot fails")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/boot.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/common/boot.c b/common/boot.c
index 149bfeca00..1d8768b864 100644
--- a/common/boot.c
+++ b/common/boot.c
@@ -107,6 +107,16 @@ static int bootscript_boot(struct bootentry *entry, int verbose, int dryrun)
 
 	bootm_data_init_defaults(&backup);
 
+	/*
+	 * The strings point to the globalvars' current values, which the
+	 * script frees when it assigns new ones. Keep our own copies.
+	 */
+	backup.os_file = xstrdup(backup.os_file);
+	backup.initrd_file = xstrdup(backup.initrd_file);
+	backup.oftree_file = xstrdup(backup.oftree_file);
+	backup.root_dev = xstrdup(backup.root_dev);
+	backup.root_param = xstrdup(backup.root_param);
+
 	globalvar_add_simple("linux.bootargs.dyn.ip", NULL);
 	globalvar_add_simple("linux.bootargs.dyn.root", NULL);
 
@@ -136,6 +146,13 @@ static int bootscript_boot(struct bootentry *entry, int verbose, int dryrun)
 	ret = bootm_entry(entry, &data);
 out:
 	bootm_data_restore_defaults(&backup);
+
+	free_const(backup.os_file);
+	free_const(backup.initrd_file);
+	free_const(backup.oftree_file);
+	free_const(backup.root_dev);
+	free_const(backup.root_param);
+
 	return ret;
 }
 

-- 
2.47.3