[U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()

[Sam Protsenko]

Hi Lukasz,

On Fri, Jul 13, 2018 at 12:49 PM, Lukasz Majewski <lukma at denx.de> wrote:
> Hi Sam,
>
>> The story of this change goes further... Just checked the reason, the
>> bug was introduced here [1]. So we can either use my patch (which adds
>> corresponding comment to ensure we won't "fix" it later), or the whole
>> design of dfu_config_entities() vs dfu_free_entities() should be
>> revised.
>>
>> Lukasz, what do you think about this?
>
> Your patch seems OK to me. I've checked all use cases and in the error
> path the dfu_free_entities() is called.
>

The patch itself is ok. What I'm trying to say, is that design of
dfu_config_entities() is not very good. It allocates memory for "dfu"
array, and on error it doesn't free it, relying on dfu_free_entities()
to free it later. That's why Coverity reported it as a memory leak in
a first place (though it was false positive of course). But such a
design is not what user of the function usually expects. Better design
(as for my taste) would be if dfu_config_entities() cleans up
everything on error, so that even if user doesn't call
dfu_free_entities() after calling dfu_config_entities() (with return
on error), there is no memory leak involved. This way it would be
easier to control code flow, and Coverity will be happy too.

I suggest next: let's merge this patch as is (at least it makes things
work as originally intended), and if my thoughts on design make sense
to you, dfu_config_entities() can be reworked in further commits.
Sounds ok?

I will send v2 with improved commit message soon.

>
> (Or have I misunderstood something) ?
>
>>
>> [1]
>> http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>>
>> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
>> <semen.protsenko at linaro.org> wrote:
>> > In case of error in dfu_config_entities(), it frees "dfu" array,
>> > which leads to "data abort" in dfu_free_entities(), which tries to
>> > free the same array (and even tries to access it from linked list
>> > first). The issue occurs e.g. when partition table on device does
>> > not match $dfu_alt_info layout:
>> >
>> >     => dfu 0 mmc 1 list
>> >     Couldn't find part #2 on mmc device #1
>> >     DFU entities configuration failed!
>> >     data abort
>> >
>> > To fix this issue, do not free "dfu" array in
>> > dfu_config_entities(). It will be freed later in
>> > dfu_free_entities().
>> >
>> > Signed-off-by: Sam Protsenko <semen.protsenko at linaro.org>
>> > ---
>> >  drivers/dfu/dfu.c | 2 +-
>> >  1 file changed, 1 insertion(+), 1 deletion(-)
>> >
>> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
>> > index e7c91193b9..a3c09334b7 100644
>> > --- a/drivers/dfu/dfu.c
>> > +++ b/drivers/dfu/dfu.c
>> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char
>> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,
>> > alt_num_cnt, interface, devstr);
>> >                 if (ret) {
>> > -                       free(dfu);
>> > +                       /* We will free "dfu" in
>> > dfu_free_entities() */ return -1;
>> >                 }
>> >
>> > --
>> > 2.18.0
>> >
>
>
>
>
> Best regards,
>
> Lukasz Majewski
>
> --
>
> DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
> HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
> Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de