[PATCH 6/8] arm64: kexec_file: Fix image->elf_headers memory leak during retry loop

[Jinjie Ruan]

Sashiko AI code review pointed out a potential memory leak of
image->elf_headers when load_other_segments() fails on error paths.

When load_other_segments() fails during the arm64 kexec_file file-load
path, execution jumps to the out_err label. While this path restores
`image->nr_segments`, it returns an error back to the caller without
freeing the allocated `image->elf_headers` vmalloc buffer.

Consequently, the retry loop in image_load() will allocate new ELF
headers on the next iteration and overwrite `image->elf_headers`,
permanently leaking the memory blocks allocated in previous iterations.

Fix this by explicitly freeing the stale `image->elf_headers` buffer
once the new headers buffer is allocated.

Cc: Catalin Marinas <catalin.marinas at arm.com>
Cc: Will Deacon <will at kernel.org>
Cc: Thomas Huth <thuth at redhat.com>
Cc: Breno Leitao <leitao at debian.org>
Cc: Andrew Morton <akpm at linux-foundation.org>
Cc: Yeoreum Yun <yeoreum.yun at arm.com>
Cc: Coiby Xu <coxu at redhat.com>
Cc: Baoquan He <bhe at redhat.com>
Cc: Kees Cook <kees at kernel.org>
Cc: Benjamin Gwin <bgwin at google.com>
Cc: stable at vger.kernel.org
Fixes: 108aa503657e ("arm64: kexec_file: try more regions if loading segments fails")
Signed-off-by: Jinjie Ruan <ruanjinjie at huawei.com>
---
 arch/arm64/kernel/machine_kexec_file.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c
index e48f29167b38..2f750e5f4fcc 100644
--- a/arch/arm64/kernel/machine_kexec_file.c
+++ b/arch/arm64/kernel/machine_kexec_file.c
@@ -112,6 +112,10 @@ int load_other_segments(struct kimage *image,
 			vfree(headers);
 			goto out_err;
 		}
+
+		if (unlikely(image->elf_headers))
+			vfree(image->elf_headers);
+
 		image->elf_headers = headers;
 		image->elf_load_addr = kbuf.mem;
 		image->elf_headers_sz = headers_sz;
-- 
2.34.1