[PATCH master 08/39] efi: loader: fix file handle leak in efi_file_from_path

[Ahmad Fatoum]

Two early return paths in the device path traversal loop fail to
close the current file handle 'f' before returning NULL:
- when the device path node has an invalid length
- when memdup fails to allocate the filename

Add f->close(f) calls before both returns.

Co-Authored-By: Claude Opus 4.6 <noreply at anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 efi/loader/protocols/file.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/efi/loader/protocols/file.c b/efi/loader/protocols/file.c
index 03d2dc3a0d38..e002057d59ea 100644
--- a/efi/loader/protocols/file.c
+++ b/efi/loader/protocols/file.c
@@ -968,17 +968,23 @@ struct efi_file_handle *efi_file_from_path(struct efi_device_path *fp)
 		 * protocol member functions to be aligned.  So memcpy it
 		 * unconditionally
 		 */
-		if (fdp->header.length <= offsetof(struct efi_device_path_file_path, path_name))
+		if (fdp->header.length <= offsetof(struct efi_device_path_file_path, path_name)) {
+			f->close(f);
 			return NULL;
+		}
 		filename_sz = fdp->header.length -
 			offsetof(struct efi_device_path_file_path, path_name);
 		filename = memdup(fdp->path_name, filename_sz);
-		if (!filename)
+		if (!filename) {
+			f->close(f);
 			return NULL;
+		}
 		efiret = f->open(f, &f2, filename, EFI_FILE_MODE_READ, 0);
 		free(filename);
-		if (efiret != EFI_SUCCESS)
+		if (efiret != EFI_SUCCESS) {
+			f->close(f);
 			return NULL;
+		}
 
 		fp = efi_dp_next(fp);
 
-- 
2.47.3