* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()
@ 2018-07-12 21:52 Sam Protsenko
2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko
` (3 more replies)
0 siblings, 4 replies; 11+ messages in thread
From: Sam Protsenko @ 2018-07-12 21:52 UTC (permalink / raw)
To: u-boot
In case of error in dfu_config_entities(), it frees "dfu" array, which
leads to "data abort" in dfu_free_entities(), which tries to free the
same array (and even tries to access it from linked list first). The
issue occurs e.g. when partition table on device does not match
$dfu_alt_info layout:
=> dfu 0 mmc 1 list
Couldn't find part #2 on mmc device #1
DFU entities configuration failed!
data abort
To fix this issue, do not free "dfu" array in dfu_config_entities(). It
will be freed later in dfu_free_entities().
Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
---
drivers/dfu/dfu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index e7c91193b9..a3c09334b7 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
devstr);
if (ret) {
- free(dfu);
+ /* We will free "dfu" in dfu_free_entities() */
return -1;
}
--
2.18.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities()
2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
@ 2018-07-12 21:52 ` Sam Protsenko
2018-07-13 9:42 ` Lukasz Majewski
2018-07-12 21:52 ` [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message Sam Protsenko
` (2 subsequent siblings)
3 siblings, 1 reply; 11+ messages in thread
From: Sam Protsenko @ 2018-07-12 21:52 UTC (permalink / raw)
To: u-boot
In case of error in dfu_init_env_entities(), env_bkp will leak. Fix it
by providing single return path.
Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
---
drivers/dfu/dfu.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index a3c09334b7..5b9abd685d 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -56,7 +56,7 @@ int dfu_init_env_entities(char *interface, char *devstr)
{
const char *str_env;
char *env_bkp;
- int ret;
+ int ret = 0;
#ifdef CONFIG_SET_DFU_ALT_INFO
set_dfu_alt_info(interface, devstr);
@@ -71,11 +71,12 @@ int dfu_init_env_entities(char *interface, char *devstr)
ret = dfu_config_entities(env_bkp, interface, devstr);
if (ret) {
pr_err("DFU entities configuration failed!\n");
- return ret;
+ goto done;
}
+done:
free(env_bkp);
- return 0;
+ return ret;
}
static unsigned char *dfu_buf;
--
2.18.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message
2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko
@ 2018-07-12 21:52 ` Sam Protsenko
2018-07-13 9:43 ` Lukasz Majewski
2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
2018-07-13 9:41 ` Lukasz Majewski
3 siblings, 1 reply; 11+ messages in thread
From: Sam Protsenko @ 2018-07-12 21:52 UTC (permalink / raw)
To: u-boot
It might be useful for user to see some human-readable root cause
message in addition to "configuration failed" message, so that the issue
can be fixed quickly.
Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
---
drivers/dfu/dfu.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index 5b9abd685d..318949529b 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -71,6 +71,7 @@ int dfu_init_env_entities(char *interface, char *devstr)
ret = dfu_config_entities(env_bkp, interface, devstr);
if (ret) {
pr_err("DFU entities configuration failed!\n");
+ pr_err("(partition table does not match dfu_alt_info?)\n");
goto done;
}
--
2.18.0
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()
2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko
2018-07-12 21:52 ` [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message Sam Protsenko
@ 2018-07-12 22:10 ` Sam Protsenko
2018-07-13 2:32 ` Andy Shevchenko
2018-07-13 9:49 ` Lukasz Majewski
2018-07-13 9:41 ` Lukasz Majewski
3 siblings, 2 replies; 11+ messages in thread
From: Sam Protsenko @ 2018-07-12 22:10 UTC (permalink / raw)
To: u-boot
The story of this change goes further... Just checked the reason, the
bug was introduced here [1]. So we can either use my patch (which adds
corresponding comment to ensure we won't "fix" it later), or the whole
design of dfu_config_entities() vs dfu_free_entities() should be
revised.
Lukasz, what do you think about this?
[1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
<semen.protsenko@linaro.org> wrote:
> In case of error in dfu_config_entities(), it frees "dfu" array, which
> leads to "data abort" in dfu_free_entities(), which tries to free the
> same array (and even tries to access it from linked list first). The
> issue occurs e.g. when partition table on device does not match
> $dfu_alt_info layout:
>
> => dfu 0 mmc 1 list
> Couldn't find part #2 on mmc device #1
> DFU entities configuration failed!
> data abort
>
> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
> will be freed later in dfu_free_entities().
>
> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> ---
> drivers/dfu/dfu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index e7c91193b9..a3c09334b7 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
> ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
> devstr);
> if (ret) {
> - free(dfu);
> + /* We will free "dfu" in dfu_free_entities() */
> return -1;
> }
>
> --
> 2.18.0
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()
2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
@ 2018-07-13 2:32 ` Andy Shevchenko
2018-07-13 13:18 ` Sam Protsenko
2018-07-13 9:49 ` Lukasz Majewski
1 sibling, 1 reply; 11+ messages in thread
From: Andy Shevchenko @ 2018-07-13 2:32 UTC (permalink / raw)
To: u-boot
On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko
<semen.protsenko@linaro.org> wrote:
> The story of this change goes further... Just checked the reason, the
> bug was introduced here [1]. So we can either use my patch (which adds
> corresponding comment to ensure we won't "fix" it later), or the whole
> design of dfu_config_entities() vs dfu_free_entities() should be
> revised.
Effectively you are reverting that commit, perhaps make it clear in
commit message that this is a revert.
>
> Lukasz, what do you think about this?
>
> [1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>
> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
> <semen.protsenko@linaro.org> wrote:
>> In case of error in dfu_config_entities(), it frees "dfu" array, which
>> leads to "data abort" in dfu_free_entities(), which tries to free the
>> same array (and even tries to access it from linked list first). The
>> issue occurs e.g. when partition table on device does not match
>> $dfu_alt_info layout:
>>
>> => dfu 0 mmc 1 list
>> Couldn't find part #2 on mmc device #1
>> DFU entities configuration failed!
>> data abort
>>
>> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
>> will be freed later in dfu_free_entities().
>>
>> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
>> ---
>> drivers/dfu/dfu.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
>> index e7c91193b9..a3c09334b7 100644
>> --- a/drivers/dfu/dfu.c
>> +++ b/drivers/dfu/dfu.c
>> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
>> ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
>> devstr);
>> if (ret) {
>> - free(dfu);
>> + /* We will free "dfu" in dfu_free_entities() */
>> return -1;
>> }
>>
>> --
>> 2.18.0
>>
> _______________________________________________
> U-Boot mailing list
> U-Boot at lists.denx.de
> https://lists.denx.de/listinfo/u-boot
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()
2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
` (2 preceding siblings ...)
2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
@ 2018-07-13 9:41 ` Lukasz Majewski
3 siblings, 0 replies; 11+ messages in thread
From: Lukasz Majewski @ 2018-07-13 9:41 UTC (permalink / raw)
To: u-boot
Hi Sam,
> In case of error in dfu_config_entities(), it frees "dfu" array, which
> leads to "data abort" in dfu_free_entities(), which tries to free the
> same array (and even tries to access it from linked list first). The
> issue occurs e.g. when partition table on device does not match
> $dfu_alt_info layout:
>
> => dfu 0 mmc 1 list
> Couldn't find part #2 on mmc device #1
> DFU entities configuration failed!
> data abort
>
> To fix this issue, do not free "dfu" array in dfu_config_entities().
> It will be freed later in dfu_free_entities().
>
> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> ---
> drivers/dfu/dfu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index e7c91193b9..a3c09334b7 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char
> *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,
> alt_num_cnt, interface, devstr);
> if (ret) {
> - free(dfu);
> + /* We will free "dfu" in dfu_free_entities()
> */ return -1;
> }
>
Thanks for catching it.
Acked-by: Lukasz Majewski <lukma@denx.de>
Best regards,
Lukasz Majewski
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/8c4bfe64/attachment.sig>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities()
2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko
@ 2018-07-13 9:42 ` Lukasz Majewski
0 siblings, 0 replies; 11+ messages in thread
From: Lukasz Majewski @ 2018-07-13 9:42 UTC (permalink / raw)
To: u-boot
Hi Sam,
> In case of error in dfu_init_env_entities(), env_bkp will leak. Fix it
> by providing single return path.
>
> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> ---
> drivers/dfu/dfu.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index a3c09334b7..5b9abd685d 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -56,7 +56,7 @@ int dfu_init_env_entities(char *interface, char
> *devstr) {
> const char *str_env;
> char *env_bkp;
> - int ret;
> + int ret = 0;
>
> #ifdef CONFIG_SET_DFU_ALT_INFO
> set_dfu_alt_info(interface, devstr);
> @@ -71,11 +71,12 @@ int dfu_init_env_entities(char *interface, char
> *devstr) ret = dfu_config_entities(env_bkp, interface, devstr);
> if (ret) {
> pr_err("DFU entities configuration failed!\n");
> - return ret;
> + goto done;
> }
>
> +done:
> free(env_bkp);
> - return 0;
> + return ret;
> }
>
> static unsigned char *dfu_buf;
Acked-by: Lukasz Majewski <lukma@denx.de>
Best regards,
Lukasz Majewski
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/dc3f619d/attachment.sig>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message
2018-07-12 21:52 ` [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message Sam Protsenko
@ 2018-07-13 9:43 ` Lukasz Majewski
0 siblings, 0 replies; 11+ messages in thread
From: Lukasz Majewski @ 2018-07-13 9:43 UTC (permalink / raw)
To: u-boot
Hi Sam,
> It might be useful for user to see some human-readable root cause
> message in addition to "configuration failed" message, so that the
> issue can be fixed quickly.
>
> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> ---
> drivers/dfu/dfu.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index 5b9abd685d..318949529b 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -71,6 +71,7 @@ int dfu_init_env_entities(char *interface, char
> *devstr) ret = dfu_config_entities(env_bkp, interface, devstr);
> if (ret) {
> pr_err("DFU entities configuration failed!\n");
> + pr_err("(partition table does not match
> dfu_alt_info?)\n"); goto done;
> }
>
Acked-by: Lukasz Majewski <lukma@denx.de>
Best regards,
Lukasz Majewski
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/a3f12125/attachment.sig>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()
2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
2018-07-13 2:32 ` Andy Shevchenko
@ 2018-07-13 9:49 ` Lukasz Majewski
2018-07-13 13:28 ` Sam Protsenko
1 sibling, 1 reply; 11+ messages in thread
From: Lukasz Majewski @ 2018-07-13 9:49 UTC (permalink / raw)
To: u-boot
Hi Sam,
> The story of this change goes further... Just checked the reason, the
> bug was introduced here [1]. So we can either use my patch (which adds
> corresponding comment to ensure we won't "fix" it later), or the whole
> design of dfu_config_entities() vs dfu_free_entities() should be
> revised.
>
> Lukasz, what do you think about this?
Your patch seems OK to me. I've checked all use cases and in the error
path the dfu_free_entities() is called.
(Or have I misunderstood something) ?
>
> [1]
> http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>
> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
> <semen.protsenko@linaro.org> wrote:
> > In case of error in dfu_config_entities(), it frees "dfu" array,
> > which leads to "data abort" in dfu_free_entities(), which tries to
> > free the same array (and even tries to access it from linked list
> > first). The issue occurs e.g. when partition table on device does
> > not match $dfu_alt_info layout:
> >
> > => dfu 0 mmc 1 list
> > Couldn't find part #2 on mmc device #1
> > DFU entities configuration failed!
> > data abort
> >
> > To fix this issue, do not free "dfu" array in
> > dfu_config_entities(). It will be freed later in
> > dfu_free_entities().
> >
> > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> > ---
> > drivers/dfu/dfu.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> > index e7c91193b9..a3c09334b7 100644
> > --- a/drivers/dfu/dfu.c
> > +++ b/drivers/dfu/dfu.c
> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char
> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,
> > alt_num_cnt, interface, devstr);
> > if (ret) {
> > - free(dfu);
> > + /* We will free "dfu" in
> > dfu_free_entities() */ return -1;
> > }
> >
> > --
> > 2.18.0
> >
Best regards,
Lukasz Majewski
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/a3e528e5/attachment.sig>
^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()
2018-07-13 2:32 ` Andy Shevchenko
@ 2018-07-13 13:18 ` Sam Protsenko
0 siblings, 0 replies; 11+ messages in thread
From: Sam Protsenko @ 2018-07-13 13:18 UTC (permalink / raw)
To: u-boot
On Fri, Jul 13, 2018 at 5:32 AM, Andy Shevchenko
<andy.shevchenko@gmail.com> wrote:
> On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko
> <semen.protsenko@linaro.org> wrote:
>> The story of this change goes further... Just checked the reason, the
>> bug was introduced here [1]. So we can either use my patch (which adds
>> corresponding comment to ensure we won't "fix" it later), or the whole
>> design of dfu_config_entities() vs dfu_free_entities() should be
>> revised.
>
> Effectively you are reverting that commit, perhaps make it clear in
> commit message that this is a revert.
>
Yeah, I just found that commit after sending my patch. Will add that
info in v2, thanks.
>>
>> Lukasz, what do you think about this?
>>
>> [1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>>
>> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
>> <semen.protsenko@linaro.org> wrote:
>>> In case of error in dfu_config_entities(), it frees "dfu" array, which
>>> leads to "data abort" in dfu_free_entities(), which tries to free the
>>> same array (and even tries to access it from linked list first). The
>>> issue occurs e.g. when partition table on device does not match
>>> $dfu_alt_info layout:
>>>
>>> => dfu 0 mmc 1 list
>>> Couldn't find part #2 on mmc device #1
>>> DFU entities configuration failed!
>>> data abort
>>>
>>> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
>>> will be freed later in dfu_free_entities().
>>>
>>> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
>>> ---
>>> drivers/dfu/dfu.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
>>> index e7c91193b9..a3c09334b7 100644
>>> --- a/drivers/dfu/dfu.c
>>> +++ b/drivers/dfu/dfu.c
>>> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
>>> ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
>>> devstr);
>>> if (ret) {
>>> - free(dfu);
>>> + /* We will free "dfu" in dfu_free_entities() */
>>> return -1;
>>> }
>>>
>>> --
>>> 2.18.0
>>>
>> _______________________________________________
>> U-Boot mailing list
>> U-Boot at lists.denx.de
>> https://lists.denx.de/listinfo/u-boot
>
>
>
> --
> With Best Regards,
> Andy Shevchenko
^ permalink raw reply [flat|nested] 11+ messages in thread
* [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()
2018-07-13 9:49 ` Lukasz Majewski
@ 2018-07-13 13:28 ` Sam Protsenko
0 siblings, 0 replies; 11+ messages in thread
From: Sam Protsenko @ 2018-07-13 13:28 UTC (permalink / raw)
To: u-boot
Hi Lukasz,
On Fri, Jul 13, 2018 at 12:49 PM, Lukasz Majewski <lukma@denx.de> wrote:
> Hi Sam,
>
>> The story of this change goes further... Just checked the reason, the
>> bug was introduced here [1]. So we can either use my patch (which adds
>> corresponding comment to ensure we won't "fix" it later), or the whole
>> design of dfu_config_entities() vs dfu_free_entities() should be
>> revised.
>>
>> Lukasz, what do you think about this?
>
> Your patch seems OK to me. I've checked all use cases and in the error
> path the dfu_free_entities() is called.
>
The patch itself is ok. What I'm trying to say, is that design of
dfu_config_entities() is not very good. It allocates memory for "dfu"
array, and on error it doesn't free it, relying on dfu_free_entities()
to free it later. That's why Coverity reported it as a memory leak in
a first place (though it was false positive of course). But such a
design is not what user of the function usually expects. Better design
(as for my taste) would be if dfu_config_entities() cleans up
everything on error, so that even if user doesn't call
dfu_free_entities() after calling dfu_config_entities() (with return
on error), there is no memory leak involved. This way it would be
easier to control code flow, and Coverity will be happy too.
I suggest next: let's merge this patch as is (at least it makes things
work as originally intended), and if my thoughts on design make sense
to you, dfu_config_entities() can be reworked in further commits.
Sounds ok?
I will send v2 with improved commit message soon.
>
> (Or have I misunderstood something) ?
>
>>
>> [1]
>> http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>>
>> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
>> <semen.protsenko@linaro.org> wrote:
>> > In case of error in dfu_config_entities(), it frees "dfu" array,
>> > which leads to "data abort" in dfu_free_entities(), which tries to
>> > free the same array (and even tries to access it from linked list
>> > first). The issue occurs e.g. when partition table on device does
>> > not match $dfu_alt_info layout:
>> >
>> > => dfu 0 mmc 1 list
>> > Couldn't find part #2 on mmc device #1
>> > DFU entities configuration failed!
>> > data abort
>> >
>> > To fix this issue, do not free "dfu" array in
>> > dfu_config_entities(). It will be freed later in
>> > dfu_free_entities().
>> >
>> > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
>> > ---
>> > drivers/dfu/dfu.c | 2 +-
>> > 1 file changed, 1 insertion(+), 1 deletion(-)
>> >
>> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
>> > index e7c91193b9..a3c09334b7 100644
>> > --- a/drivers/dfu/dfu.c
>> > +++ b/drivers/dfu/dfu.c
>> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char
>> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,
>> > alt_num_cnt, interface, devstr);
>> > if (ret) {
>> > - free(dfu);
>> > + /* We will free "dfu" in
>> > dfu_free_entities() */ return -1;
>> > }
>> >
>> > --
>> > 2.18.0
>> >
>
>
>
>
> Best regards,
>
> Lukasz Majewski
>
> --
>
> DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
> HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
> Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2018-07-13 13:28 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-12 21:52 [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
2018-07-12 21:52 ` [U-Boot] [PATCH 2/3] dfu: Fix memory leak in dfu_init_env_entities() Sam Protsenko
2018-07-13 9:42 ` Lukasz Majewski
2018-07-12 21:52 ` [U-Boot] [PATCH 3/3] dfu: Provide more verbose error message Sam Protsenko
2018-07-13 9:43 ` Lukasz Majewski
2018-07-12 22:10 ` [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() Sam Protsenko
2018-07-13 2:32 ` Andy Shevchenko
2018-07-13 13:18 ` Sam Protsenko
2018-07-13 9:49 ` Lukasz Majewski
2018-07-13 13:28 ` Sam Protsenko
2018-07-13 9:41 ` Lukasz Majewski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.