* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()
@ 2018-07-12 21:52 Sam Protsenko
2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko
` (3 more replies)
0 siblings, 4 replies; 11+ messages in thread
From: Sam Protsenko @ 2018-07-12 21:52 UTC (permalink / raw)
To: u-boot
In case of error in dfu_config_entities(), it frees "dfu" array, which
leads to "data abort" in dfu_free_entities(), which tries to free the
same array (and even tries to access it from linked list first). The
issue occurs e.g. when partition table on device does not match
$dfu_alt_info layout:
=> dfu 0 mmc 1 list
Couldn't find part #2 on mmc device #1
DFU entities configuration failed!
data abort
To fix this issue, do not free "dfu" array in dfu_config_entities(). It
will be freed later in dfu_free_entities().
Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
---
drivers/dfu/dfu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index e7c91193b9..a3c09334b7 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
devstr);
if (ret) {
- free(dfu);
+ /* We will free "dfu" in dfu_free_entities() */
return -1;
}
--
2.18.0
^ permalink raw reply related [flat|nested] 11+ messages in thread* [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() 2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko @ 2018-07-12 21:52 ` Sam Protsenko 2018-07-13 9:42 ` Lukasz Majewski 2018-07-12 21:52 ` [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message Sam Protsenko ` (2 subsequent siblings) 3 siblings, 1 reply; 11+ messages in thread From: Sam Protsenko @ 2018-07-12 21:52 UTC (permalink / raw) To: u-boot In case of error in dfu_init_env_entities(), env_bkp will leak. Fix it by providing single return path. Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> --- drivers/dfu/dfu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index a3c09334b7..5b9abd685d 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -56,7 +56,7 @@ int dfu_init_env_entities(char *interface, char *devstr) { const char *str_env; char *env_bkp; - int ret; + int ret = 0; #ifdef CONFIG_SET_DFU_ALT_INFO set_dfu_alt_info(interface, devstr); @@ -71,11 +71,12 @@ int dfu_init_env_entities(char *interface, char *devstr) ret = dfu_config_entities(env_bkp, interface, devstr); if (ret) { pr_err("DFU entities configuration failed!\n"); - return ret; + goto done; } +done: free(env_bkp); - return 0; + return ret; } static unsigned char *dfu_buf; -- 2.18.0 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() 2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko @ 2018-07-13 9:42 ` Lukasz Majewski 0 siblings, 0 replies; 11+ messages in thread From: Lukasz Majewski @ 2018-07-13 9:42 UTC (permalink / raw) To: u-boot Hi Sam, > In case of error in dfu_init_env_entities(), env_bkp will leak. Fix it > by providing single return path. > > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> > --- > drivers/dfu/dfu.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c > index a3c09334b7..5b9abd685d 100644 > --- a/drivers/dfu/dfu.c > +++ b/drivers/dfu/dfu.c > @@ -56,7 +56,7 @@ int dfu_init_env_entities(char *interface, char > *devstr) { > const char *str_env; > char *env_bkp; > - int ret; > + int ret = 0; > > #ifdef CONFIG_SET_DFU_ALT_INFO > set_dfu_alt_info(interface, devstr); > @@ -71,11 +71,12 @@ int dfu_init_env_entities(char *interface, char > *devstr) ret = dfu_config_entities(env_bkp, interface, devstr); > if (ret) { > pr_err("DFU entities configuration failed!\n"); > - return ret; > + goto done; > } > > +done: > free(env_bkp); > - return 0; > + return ret; > } > > static unsigned char *dfu_buf; Acked-by: Lukasz Majewski <lukma@denx.de> Best regards, Lukasz Majewski -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 488 bytes Desc: OpenPGP digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/dc3f619d/attachment.sig> ^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message 2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko 2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko @ 2018-07-12 21:52 ` Sam Protsenko 2018-07-13 9:43 ` Lukasz Majewski 2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko 2018-07-13 9:41 ` Lukasz Majewski 3 siblings, 1 reply; 11+ messages in thread From: Sam Protsenko @ 2018-07-12 21:52 UTC (permalink / raw) To: u-boot It might be useful for user to see some human-readable root cause message in addition to "configuration failed" message, so that the issue can be fixed quickly. Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> --- drivers/dfu/dfu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index 5b9abd685d..318949529b 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -71,6 +71,7 @@ int dfu_init_env_entities(char *interface, char *devstr) ret = dfu_config_entities(env_bkp, interface, devstr); if (ret) { pr_err("DFU entities configuration failed!\n"); + pr_err("(partition table does not match dfu_alt_info?)\n"); goto done; } -- 2.18.0 ^ permalink raw reply related [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message 2018-07-12 21:52 ` [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message Sam Protsenko @ 2018-07-13 9:43 ` Lukasz Majewski 0 siblings, 0 replies; 11+ messages in thread From: Lukasz Majewski @ 2018-07-13 9:43 UTC (permalink / raw) To: u-boot Hi Sam, > It might be useful for user to see some human-readable root cause > message in addition to "configuration failed" message, so that the > issue can be fixed quickly. > > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> > --- > drivers/dfu/dfu.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c > index 5b9abd685d..318949529b 100644 > --- a/drivers/dfu/dfu.c > +++ b/drivers/dfu/dfu.c > @@ -71,6 +71,7 @@ int dfu_init_env_entities(char *interface, char > *devstr) ret = dfu_config_entities(env_bkp, interface, devstr); > if (ret) { > pr_err("DFU entities configuration failed!\n"); > + pr_err("(partition table does not match > dfu_alt_info?)\n"); goto done; > } > Acked-by: Lukasz Majewski <lukma@denx.de> Best regards, Lukasz Majewski -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 488 bytes Desc: OpenPGP digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/a3f12125/attachment.sig> ^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() 2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko 2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko 2018-07-12 21:52 ` [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message Sam Protsenko @ 2018-07-12 22:10 ` Sam Protsenko 2018-07-13 2:32 ` Andy Shevchenko 2018-07-13 9:49 ` Lukasz Majewski 2018-07-13 9:41 ` Lukasz Majewski 3 siblings, 2 replies; 11+ messages in thread From: Sam Protsenko @ 2018-07-12 22:10 UTC (permalink / raw) To: u-boot The story of this change goes further... Just checked the reason, the bug was introduced here [1]. So we can either use my patch (which adds corresponding comment to ensure we won't "fix" it later), or the whole design of dfu_config_entities() vs dfu_free_entities() should be revised. Lukasz, what do you think about this? [1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko <semen.protsenko@linaro.org> wrote: > In case of error in dfu_config_entities(), it frees "dfu" array, which > leads to "data abort" in dfu_free_entities(), which tries to free the > same array (and even tries to access it from linked list first). The > issue occurs e.g. when partition table on device does not match > $dfu_alt_info layout: > > => dfu 0 mmc 1 list > Couldn't find part #2 on mmc device #1 > DFU entities configuration failed! > data abort > > To fix this issue, do not free "dfu" array in dfu_config_entities(). It > will be freed later in dfu_free_entities(). > > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> > --- > drivers/dfu/dfu.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c > index e7c91193b9..a3c09334b7 100644 > --- a/drivers/dfu/dfu.c > +++ b/drivers/dfu/dfu.c > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr) > ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, > devstr); > if (ret) { > - free(dfu); > + /* We will free "dfu" in dfu_free_entities() */ > return -1; > } > > -- > 2.18.0 > ^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() 2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko @ 2018-07-13 2:32 ` Andy Shevchenko 2018-07-13 13:18 ` Sam Protsenko 2018-07-13 9:49 ` Lukasz Majewski 1 sibling, 1 reply; 11+ messages in thread From: Andy Shevchenko @ 2018-07-13 2:32 UTC (permalink / raw) To: u-boot On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko <semen.protsenko@linaro.org> wrote: > The story of this change goes further... Just checked the reason, the > bug was introduced here [1]. So we can either use my patch (which adds > corresponding comment to ensure we won't "fix" it later), or the whole > design of dfu_config_entities() vs dfu_free_entities() should be > revised. Effectively you are reverting that commit, perhaps make it clear in commit message that this is a revert. > > Lukasz, what do you think about this? > > [1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba > > On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko > <semen.protsenko@linaro.org> wrote: >> In case of error in dfu_config_entities(), it frees "dfu" array, which >> leads to "data abort" in dfu_free_entities(), which tries to free the >> same array (and even tries to access it from linked list first). The >> issue occurs e.g. when partition table on device does not match >> $dfu_alt_info layout: >> >> => dfu 0 mmc 1 list >> Couldn't find part #2 on mmc device #1 >> DFU entities configuration failed! >> data abort >> >> To fix this issue, do not free "dfu" array in dfu_config_entities(). It >> will be freed later in dfu_free_entities(). >> >> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> >> --- >> drivers/dfu/dfu.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c >> index e7c91193b9..a3c09334b7 100644 >> --- a/drivers/dfu/dfu.c >> +++ b/drivers/dfu/dfu.c >> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr) >> ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, >> devstr); >> if (ret) { >> - free(dfu); >> + /* We will free "dfu" in dfu_free_entities() */ >> return -1; >> } >> >> -- >> 2.18.0 >> > _______________________________________________ > U-Boot mailing list > U-Boot at lists.denx.de > https://lists.denx.de/listinfo/u-boot -- With Best Regards, Andy Shevchenko ^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() 2018-07-13 2:32 ` Andy Shevchenko @ 2018-07-13 13:18 ` Sam Protsenko 0 siblings, 0 replies; 11+ messages in thread From: Sam Protsenko @ 2018-07-13 13:18 UTC (permalink / raw) To: u-boot On Fri, Jul 13, 2018 at 5:32 AM, Andy Shevchenko <andy.shevchenko@gmail.com> wrote: > On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko > <semen.protsenko@linaro.org> wrote: >> The story of this change goes further... Just checked the reason, the >> bug was introduced here [1]. So we can either use my patch (which adds >> corresponding comment to ensure we won't "fix" it later), or the whole >> design of dfu_config_entities() vs dfu_free_entities() should be >> revised. > > Effectively you are reverting that commit, perhaps make it clear in > commit message that this is a revert. > Yeah, I just found that commit after sending my patch. Will add that info in v2, thanks. >> >> Lukasz, what do you think about this? >> >> [1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba >> >> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko >> <semen.protsenko@linaro.org> wrote: >>> In case of error in dfu_config_entities(), it frees "dfu" array, which >>> leads to "data abort" in dfu_free_entities(), which tries to free the >>> same array (and even tries to access it from linked list first). The >>> issue occurs e.g. when partition table on device does not match >>> $dfu_alt_info layout: >>> >>> => dfu 0 mmc 1 list >>> Couldn't find part #2 on mmc device #1 >>> DFU entities configuration failed! >>> data abort >>> >>> To fix this issue, do not free "dfu" array in dfu_config_entities(). It >>> will be freed later in dfu_free_entities(). >>> >>> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> >>> --- >>> drivers/dfu/dfu.c | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> >>> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c >>> index e7c91193b9..a3c09334b7 100644 >>> --- a/drivers/dfu/dfu.c >>> +++ b/drivers/dfu/dfu.c >>> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr) >>> ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, >>> devstr); >>> if (ret) { >>> - free(dfu); >>> + /* We will free "dfu" in dfu_free_entities() */ >>> return -1; >>> } >>> >>> -- >>> 2.18.0 >>> >> _______________________________________________ >> U-Boot mailing list >> U-Boot at lists.denx.de >> https://lists.denx.de/listinfo/u-boot > > > > -- > With Best Regards, > Andy Shevchenko ^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() 2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko 2018-07-13 2:32 ` Andy Shevchenko @ 2018-07-13 9:49 ` Lukasz Majewski 2018-07-13 13:28 ` Sam Protsenko 1 sibling, 1 reply; 11+ messages in thread From: Lukasz Majewski @ 2018-07-13 9:49 UTC (permalink / raw) To: u-boot Hi Sam, > The story of this change goes further... Just checked the reason, the > bug was introduced here [1]. So we can either use my patch (which adds > corresponding comment to ensure we won't "fix" it later), or the whole > design of dfu_config_entities() vs dfu_free_entities() should be > revised. > > Lukasz, what do you think about this? Your patch seems OK to me. I've checked all use cases and in the error path the dfu_free_entities() is called. (Or have I misunderstood something) ? > > [1] > http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba > > On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko > <semen.protsenko@linaro.org> wrote: > > In case of error in dfu_config_entities(), it frees "dfu" array, > > which leads to "data abort" in dfu_free_entities(), which tries to > > free the same array (and even tries to access it from linked list > > first). The issue occurs e.g. when partition table on device does > > not match $dfu_alt_info layout: > > > > => dfu 0 mmc 1 list > > Couldn't find part #2 on mmc device #1 > > DFU entities configuration failed! > > data abort > > > > To fix this issue, do not free "dfu" array in > > dfu_config_entities(). It will be freed later in > > dfu_free_entities(). > > > > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> > > --- > > drivers/dfu/dfu.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c > > index e7c91193b9..a3c09334b7 100644 > > --- a/drivers/dfu/dfu.c > > +++ b/drivers/dfu/dfu.c > > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char > > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, > > alt_num_cnt, interface, devstr); > > if (ret) { > > - free(dfu); > > + /* We will free "dfu" in > > dfu_free_entities() */ return -1; > > } > > > > -- > > 2.18.0 > > Best regards, Lukasz Majewski -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 488 bytes Desc: OpenPGP digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/a3e528e5/attachment.sig> ^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() 2018-07-13 9:49 ` Lukasz Majewski @ 2018-07-13 13:28 ` Sam Protsenko 0 siblings, 0 replies; 11+ messages in thread From: Sam Protsenko @ 2018-07-13 13:28 UTC (permalink / raw) To: u-boot Hi Lukasz, On Fri, Jul 13, 2018 at 12:49 PM, Lukasz Majewski <lukma@denx.de> wrote: > Hi Sam, > >> The story of this change goes further... Just checked the reason, the >> bug was introduced here [1]. So we can either use my patch (which adds >> corresponding comment to ensure we won't "fix" it later), or the whole >> design of dfu_config_entities() vs dfu_free_entities() should be >> revised. >> >> Lukasz, what do you think about this? > > Your patch seems OK to me. I've checked all use cases and in the error > path the dfu_free_entities() is called. > The patch itself is ok. What I'm trying to say, is that design of dfu_config_entities() is not very good. It allocates memory for "dfu" array, and on error it doesn't free it, relying on dfu_free_entities() to free it later. That's why Coverity reported it as a memory leak in a first place (though it was false positive of course). But such a design is not what user of the function usually expects. Better design (as for my taste) would be if dfu_config_entities() cleans up everything on error, so that even if user doesn't call dfu_free_entities() after calling dfu_config_entities() (with return on error), there is no memory leak involved. This way it would be easier to control code flow, and Coverity will be happy too. I suggest next: let's merge this patch as is (at least it makes things work as originally intended), and if my thoughts on design make sense to you, dfu_config_entities() can be reworked in further commits. Sounds ok? I will send v2 with improved commit message soon. > > (Or have I misunderstood something) ? > >> >> [1] >> http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba >> >> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko >> <semen.protsenko@linaro.org> wrote: >> > In case of error in dfu_config_entities(), it frees "dfu" array, >> > which leads to "data abort" in dfu_free_entities(), which tries to >> > free the same array (and even tries to access it from linked list >> > first). The issue occurs e.g. when partition table on device does >> > not match $dfu_alt_info layout: >> > >> > => dfu 0 mmc 1 list >> > Couldn't find part #2 on mmc device #1 >> > DFU entities configuration failed! >> > data abort >> > >> > To fix this issue, do not free "dfu" array in >> > dfu_config_entities(). It will be freed later in >> > dfu_free_entities(). >> > >> > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> >> > --- >> > drivers/dfu/dfu.c | 2 +- >> > 1 file changed, 1 insertion(+), 1 deletion(-) >> > >> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c >> > index e7c91193b9..a3c09334b7 100644 >> > --- a/drivers/dfu/dfu.c >> > +++ b/drivers/dfu/dfu.c >> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char >> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, >> > alt_num_cnt, interface, devstr); >> > if (ret) { >> > - free(dfu); >> > + /* We will free "dfu" in >> > dfu_free_entities() */ return -1; >> > } >> > >> > -- >> > 2.18.0 >> > > > > > > Best regards, > > Lukasz Majewski > > -- > > DENX Software Engineering GmbH, Managing Director: Wolfgang Denk > HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany > Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de ^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() 2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko ` (2 preceding siblings ...) 2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko @ 2018-07-13 9:41 ` Lukasz Majewski 3 siblings, 0 replies; 11+ messages in thread From: Lukasz Majewski @ 2018-07-13 9:41 UTC (permalink / raw) To: u-boot Hi Sam, > In case of error in dfu_config_entities(), it frees "dfu" array, which > leads to "data abort" in dfu_free_entities(), which tries to free the > same array (and even tries to access it from linked list first). The > issue occurs e.g. when partition table on device does not match > $dfu_alt_info layout: > > => dfu 0 mmc 1 list > Couldn't find part #2 on mmc device #1 > DFU entities configuration failed! > data abort > > To fix this issue, do not free "dfu" array in dfu_config_entities(). > It will be freed later in dfu_free_entities(). > > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org> > --- > drivers/dfu/dfu.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c > index e7c91193b9..a3c09334b7 100644 > --- a/drivers/dfu/dfu.c > +++ b/drivers/dfu/dfu.c > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, > alt_num_cnt, interface, devstr); > if (ret) { > - free(dfu); > + /* We will free "dfu" in dfu_free_entities() > */ return -1; > } > Thanks for catching it. Acked-by: Lukasz Majewski <lukma@denx.de> Best regards, Lukasz Majewski -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 488 bytes Desc: OpenPGP digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/8c4bfe64/attachment.sig> ^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2018-07-13 13:28 UTC | newest] Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko 2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko 2018-07-13 9:42 ` Lukasz Majewski 2018-07-12 21:52 ` [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message Sam Protsenko 2018-07-13 9:43 ` Lukasz Majewski 2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko 2018-07-13 2:32 ` Andy Shevchenko 2018-07-13 13:18 ` Sam Protsenko 2018-07-13 9:49 ` Lukasz Majewski 2018-07-13 13:28 ` Sam Protsenko 2018-07-13 9:41 ` Lukasz Majewski
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.