[U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()

[Lukasz Majewski]

Hi Sam,

> The story of this change goes further... Just checked the reason, the
> bug was introduced here [1]. So we can either use my patch (which adds
> corresponding comment to ensure we won't "fix" it later), or the whole
> design of dfu_config_entities() vs dfu_free_entities() should be
> revised.
> 
> Lukasz, what do you think about this?

Your patch seems OK to me. I've checked all use cases and in the error
path the dfu_free_entities() is called.


(Or have I misunderstood something) ?

> 
> [1]
> http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
> 
> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
> <semen.protsenko at linaro.org> wrote:
> > In case of error in dfu_config_entities(), it frees "dfu" array,
> > which leads to "data abort" in dfu_free_entities(), which tries to
> > free the same array (and even tries to access it from linked list
> > first). The issue occurs e.g. when partition table on device does
> > not match $dfu_alt_info layout:
> >  
> >     => dfu 0 mmc 1 list  
> >     Couldn't find part #2 on mmc device #1
> >     DFU entities configuration failed!
> >     data abort
> >
> > To fix this issue, do not free "dfu" array in
> > dfu_config_entities(). It will be freed later in
> > dfu_free_entities().
> >
> > Signed-off-by: Sam Protsenko <semen.protsenko at linaro.org>
> > ---
> >  drivers/dfu/dfu.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> > index e7c91193b9..a3c09334b7 100644
> > --- a/drivers/dfu/dfu.c
> > +++ b/drivers/dfu/dfu.c
> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char
> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,
> > alt_num_cnt, interface, devstr);
> >                 if (ret) {
> > -                       free(dfu);
> > +                       /* We will free "dfu" in
> > dfu_free_entities() */ return -1;
> >                 }
> >
> > --
> > 2.18.0
> >  




Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/a3e528e5/attachment.sig>