From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lukasz Majewski Date: Fri, 13 Jul 2018 11:49:18 +0200 Subject: [U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities() In-Reply-To: References: <20180712215253.4290-1-semen.protsenko@linaro.org> Message-ID: <20180713114918.72606eeb@jawa> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de Hi Sam, > The story of this change goes further... Just checked the reason, the > bug was introduced here [1]. So we can either use my patch (which adds > corresponding comment to ensure we won't "fix" it later), or the whole > design of dfu_config_entities() vs dfu_free_entities() should be > revised. > > Lukasz, what do you think about this? Your patch seems OK to me. I've checked all use cases and in the error path the dfu_free_entities() is called. (Or have I misunderstood something) ? > > [1] > http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba > > On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko > wrote: > > In case of error in dfu_config_entities(), it frees "dfu" array, > > which leads to "data abort" in dfu_free_entities(), which tries to > > free the same array (and even tries to access it from linked list > > first). The issue occurs e.g. when partition table on device does > > not match $dfu_alt_info layout: > > > > => dfu 0 mmc 1 list > > Couldn't find part #2 on mmc device #1 > > DFU entities configuration failed! > > data abort > > > > To fix this issue, do not free "dfu" array in > > dfu_config_entities(). It will be freed later in > > dfu_free_entities(). > > > > Signed-off-by: Sam Protsenko > > --- > > drivers/dfu/dfu.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c > > index e7c91193b9..a3c09334b7 100644 > > --- a/drivers/dfu/dfu.c > > +++ b/drivers/dfu/dfu.c > > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char > > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, > > alt_num_cnt, interface, devstr); > > if (ret) { > > - free(dfu); > > + /* We will free "dfu" in > > dfu_free_entities() */ return -1; > > } > > > > -- > > 2.18.0 > > Best regards, Lukasz Majewski -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 488 bytes Desc: OpenPGP digital signature URL: