git: f2186bbd63fc - main - loader.efi: free_tables() appears to free tss_pa twice.

The branch main has been updated by tsoome:

URL: https://cgit.FreeBSD.org/src/commit/?id=f2186bbd63fc4185a42740dfee8c403e3d9b2ae9

commit f2186bbd63fc4185a42740dfee8c403e3d9b2ae9
Author:     Toomas Soome <tsoome@FreeBSD.org>
AuthorDate: 2026-02-21 15:20:54 +0000
Commit:     Toomas Soome <tsoome@FreeBSD.org>
CommitDate: 2026-02-21 15:20:54 +0000

    loader.efi: free_tables() appears to free tss_pa twice.
    
    we check and reset loader_gdt_pa, but use FreePages(tss_pa).
    
    Reviewed by:    kib
    Differential Revision:  https://reviews.freebsd.org/D55179
---
 stand/efi/loader/arch/amd64/trap.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/stand/efi/loader/arch/amd64/trap.c b/stand/efi/loader/arch/amd64/trap.c
index 97e78ecccf22..ffd84db40a3a 100644
--- a/stand/efi/loader/arch/amd64/trap.c
+++ b/stand/efi/loader/arch/amd64/trap.c
@@ -74,6 +74,7 @@ static uint32_t tss_fw_seg;		/* Fw TSS segment */
 static uint32_t loader_tss;		/* Loader TSS segment */
 static struct region_descriptor fw_gdt;	/* Descriptor of pristine GDT */
 static EFI_PHYSICAL_ADDRESS loader_gdt_pa; /* Address of loader shadow GDT */
+static UINTN loader_gdt_pa_size;
 
 struct frame {
 	struct frame	*fr_savfp;
@@ -194,7 +195,7 @@ free_tables(void)
 		tss_pa = 0;
 	}
 	if (loader_gdt_pa != 0) {
-		BS->FreePages(tss_pa, 2);
+		BS->FreePages(loader_gdt_pa, loader_gdt_pa_size);
 		loader_gdt_pa = 0;
 	}
 	ist = 0;
@@ -294,13 +295,13 @@ efi_redirect_exceptions(void)
 			loader_gdt.rd_limit = roundup2(fw_gdt.rd_limit +
 			    sizeof(struct system_segment_descriptor),
 			    sizeof(struct system_segment_descriptor)) - 1;
+			loader_gdt_pa_size =
+			    EFI_SIZE_TO_PAGES(loader_gdt.rd_limit);
 			i = (loader_gdt.rd_limit + 1 -
 			    sizeof(struct system_segment_descriptor)) /
 			    sizeof(struct system_segment_descriptor) * 2;
 			status = BS->AllocatePages(AllocateAnyPages,
-			    EfiLoaderData,
-			    EFI_SIZE_TO_PAGES(loader_gdt.rd_limit),
-			    &loader_gdt_pa);
+			    EfiLoaderData, loader_gdt_pa_size, &loader_gdt_pa);
 			if (EFI_ERROR(status)) {
 				printf("efi_setup_tss: AllocatePages gdt error "
 				    "%lu\n",  DECODE_ERROR(status));