[PATCH master 18/39] efi: payload: fix EFI page leak in efi_read_file

[Ahmad Fatoum]

When read_file_into_buf() fails, the function returns NULL without
freeing the EFI pages allocated by BS->allocate_pages(). Free them
before returning.

Co-Authored-By: Claude Opus 4.6 <noreply at anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 efi/payload/image.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/efi/payload/image.c b/efi/payload/image.c
index 976327e08842..83094cda6d89 100644
--- a/efi/payload/image.c
+++ b/efi/payload/image.c
@@ -55,8 +55,10 @@ static void *efi_read_file(const char *file, size_t *size)
 	buf = efi_phys_to_virt(mem);
 
 	ret = read_file_into_buf(file, buf, s.st_size);
-	if (ret < 0)
+	if (ret < 0) {
+		BS->free_pages(mem, DIV_ROUND_UP(s.st_size, EFI_PAGE_SIZE));
 		return NULL;
+	}
 
 	*size = ret;
 	return buf;
-- 
2.47.3