On Fri, Jul 13, 2018 at 4:35 PM, Sam Protsenko
<semen.protse...@linaro.org> wrote:
> Commit 5d8fae79163e ("dfu: avoid memory leak") brings a regression which
> described below. This patch is effectively reverting that commit, adding
> corresponding comment to avoid such regressions in future.
>
> In case of error in dfu_config_entities(), it frees "dfu" array, which
> leads to "data abort" in dfu_free_entities(), which tries to free the
> same array (and even tries to access it from linked list first). The
> issue occurs e.g. when partition table on device does not match
> $dfu_alt_info layout:
>
> => dfu 0 mmc 1
> Couldn't find part #2 on mmc device #1
> DFU entities configuration failed!
> data abort
>
> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
> will be freed later in dfu_free_entities().
>
> Tested on BeagleBone Black (where this regression was originally found).
>
> Signed-off-by: Sam Protsenko <semen.protse...@linaro.org>
> ---
> Changes in v2:
> - Improve commit message by mentioning regression commit
>
Hi Lukasz,
Can you please review and merge this whole series?
Thanks!
> drivers/dfu/dfu.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index e7c91193b9..a3c09334b7 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char
> *devstr)
> ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
> devstr);
> if (ret) {
> - free(dfu);
> + /* We will free "dfu" in dfu_free_entities() */
> return -1;
> }
>
> --
> 2.18.0
>
_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
https://lists.denx.de/listinfo/u-boot
