[U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()

[Sam Protsenko <semen.protsenko@linaro.org>]

On Fri, Jul 13, 2018 at 5:32 AM, Andy Shevchenko
<andy.shevchenko@gmail.com> wrote:
> On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko
> <semen.protsenko@linaro.org> wrote:
>> The story of this change goes further... Just checked the reason, the
>> bug was introduced here [1]. So we can either use my patch (which adds
>> corresponding comment to ensure we won't "fix" it later), or the whole
>> design of dfu_config_entities() vs dfu_free_entities() should be
>> revised.
>
> Effectively you are reverting that commit, perhaps make it clear in
> commit message that this is a revert.
>

Yeah, I just found that commit after sending my patch. Will add that
info in v2, thanks.

>>
>> Lukasz, what do you think about this?
>>
>> [1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>>
>> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
>> <semen.protsenko@linaro.org> wrote:
>>> In case of error in dfu_config_entities(), it frees "dfu" array, which
>>> leads to "data abort" in dfu_free_entities(), which tries to free the
>>> same array (and even tries to access it from linked list first). The
>>> issue occurs e.g. when partition table on device does not match
>>> $dfu_alt_info layout:
>>>
>>>     => dfu 0 mmc 1 list
>>>     Couldn't find part #2 on mmc device #1
>>>     DFU entities configuration failed!
>>>     data abort
>>>
>>> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
>>> will be freed later in dfu_free_entities().
>>>
>>> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
>>> ---
>>>  drivers/dfu/dfu.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
>>> index e7c91193b9..a3c09334b7 100644
>>> --- a/drivers/dfu/dfu.c
>>> +++ b/drivers/dfu/dfu.c
>>> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
>>>                 ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
>>>                                       devstr);
>>>                 if (ret) {
>>> -                       free(dfu);
>>> +                       /* We will free "dfu" in dfu_free_entities() */
>>>                         return -1;
>>>                 }
>>>
>>> --
>>> 2.18.0
>>>
>> _______________________________________________
>> U-Boot mailing list
>> U-Boot at lists.denx.de
>> https://lists.denx.de/listinfo/u-boot
>
>
>
> --
> With Best Regards,
> Andy Shevchenko