Re: [PATCH 2/4] bootargs: fix double free in linux_bootargs_get()

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

On 10/30/26 8:34 AM, Sascha Hauer wrote:
> linux_bootargs_get() frees the previously generated bootargs before
> building them again. When no global.linux.bootargs.* variables exist,
> it returns the legacy bootargs environment variable instead, without
> resetting linux_bootargs. The next call then frees the same pointer a
> second time.
> 
> This is easily triggered by fixing up the device tree a couple of
> times, e.g. on sandbox:
> 
>   global linux.bootargs.base=console=x; of_dump -F /chosen
>   global -r linux.bootargs.base; of_dump -F /chosen
>   of_dump -F /chosen
> 
> Fix this by setting linux_bootargs to NULL after freeing it.
> 
> Fixes: ee4cab9e5874 ("booting: more flexible Linux bootargs generation")
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

I have the same patch in my UKI series[1], but cherry-picking this
directly to master is a good idea.

[1]:
https://lore.kernel.org/barebox/20261026121150.455510-4-a.fatoum@pengutronix.de/

> ---
>  common/bootargs.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/common/bootargs.c b/common/bootargs.c
> index 36528b8b58..6373d9ccb1 100644
> --- a/common/bootargs.c
> +++ b/common/bootargs.c
> @@ -32,6 +32,7 @@ const char *linux_bootargs_get(void)
>  		return linux_bootargs;
>  
>  	free(linux_bootargs);
> +	linux_bootargs = NULL;
>  
>  	bootargs = globalvar_get_match("linux.bootargs.", " ");
>  	if (!strlen(bootargs)) {
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |