From patchwork Fri Jul 13 13:35:45 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sam Protsenko X-Patchwork-Id: 141887 Delivered-To: patch@linaro.org Received: by 2002:a2e:9754:0:0:0:0:0 with SMTP id f20-v6csp814726ljj; Fri, 13 Jul 2018 06:35:56 -0700 (PDT) X-Google-Smtp-Source: AAOMgpcygwtmzHIEd5QVrlpEWN+s50pHjL1duiscSBYs2B69y2VCY1mDAhn2XjwCDp07P54dH9hC X-Received: by 2002:a50:c251:: with SMTP id t17-v6mr7125408edf.108.1531488956244; Fri, 13 Jul 2018 06:35:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1531488956; cv=none; d=google.com; s=arc-20160816; b=sImgy/nb0mUAisfihRf96gkeD65KiqzgZTQLIEJ90p079bT29z8ifJRUOloe0iuB8p ab2uKbvFaqwNmiGDx4TWOHpoX9G9xzOLS9Y6yANQVPT83j3LQ2nofp+PgQietQWTrdrC dVzAky8F9bgVj4nGJEypLBzvUiTYDl0EM0adAuNYqzA4egIumJz7P1kjPQbEWMNhpVl0 5mamBBmfZGayFPCqusoNeP11S5NykKY0ngeZI0lRLq/9XlaKwHplmG+tprOwa6rXwG/e qxFeZM+HrTMBu+Flja3UxL2bQsR//YyGPMDxLWfj9k74ml4rYT0+QFGTBfik9bucxLds NS0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:cc:message-id:date:to:from :dkim-signature:arc-authentication-results; bh=yh48wr8fFwko8T9uHQWxhXpSVyLn0tKma9Fs79RSewQ=; b=PGBZos4OPSAgobdKIsbNaZM8bgmhXq1nD3hB+hFRwhmZAfFR7/AMhTQgpzuEJIu2Z5 9WwIIxmMvN1Y/DQntSo8XLz+CXD1Nw3LBqXxyZX9r5JFJ2NW0j9GEAygYfsDmgAhWAEr Jhg//1GDQbWqp23T3f11+dGDdLJEgj6hMEG7H9AwgxQbVDycXaIypJIFB90sRY9mNlGl u7lQ8XuHSziGmcNj8QdrwPCbmowDiDo4LCooS/KraXHCMCm0tU6w7cU2pRChgTyHG2yY F3ABp3jk8Y2E1OiPtCQv+VoZTa5BpfkT6P+9v8YPn2IY8rwuS7IVkQucs942hXPgeDew Q+PA== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org header.s=google header.b=aEd19Bmu; spf=pass (google.com: best guess record for domain of u-boot-bounces@lists.denx.de designates 81.169.180.215 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.denx.de (dione.denx.de. [81.169.180.215]) by mx.google.com with ESMTP id x42-v6si343942edm.81.2018.07.13.06.35.55; Fri, 13 Jul 2018 06:35:56 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of u-boot-bounces@lists.denx.de designates 81.169.180.215 as permitted sender) client-ip=81.169.180.215; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org header.s=google header.b=aEd19Bmu; spf=pass (google.com: best guess record for domain of u-boot-bounces@lists.denx.de designates 81.169.180.215 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: by lists.denx.de (Postfix, from userid 105) id CEB47C21EB9; Fri, 13 Jul 2018 13:35:54 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, T_DKIM_INVALID autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id 4E951C21EB9; Fri, 13 Jul 2018 13:35:52 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id CD938C21E44; Fri, 13 Jul 2018 13:35:50 +0000 (UTC) Received: from mail-lf0-f67.google.com (mail-lf0-f67.google.com [209.85.215.67]) by lists.denx.de (Postfix) with ESMTPS id 5E976C21DB3 for ; Fri, 13 Jul 2018 13:35:50 +0000 (UTC) Received: by mail-lf0-f67.google.com with SMTP id l16-v6so27197156lfc.13 for ; Fri, 13 Jul 2018 06:35:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=VMo0yXRM4KjaXgHSnH19Kh9e4JE0IL1WbYopGfpXah4=; b=aEd19BmukObn20N3uSkE5Se1v1TISE3rqiYd3irv/mzwZaVyjGZMFimniSnKsLl+EN zq5wVEUzB+rMW0XZft9MG0sVTs1fI5cWTXYLXOid0EB5L4RNAOOErD1FShN7PADQ25+e 3VhqdHsnARTCXG55uQwHZF7ZGa9HyqECnKEdU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=VMo0yXRM4KjaXgHSnH19Kh9e4JE0IL1WbYopGfpXah4=; b=kwJtq/uoCuuMPTQXepdavU7T+1LADLj/fyMlzQmguTpe4n9CmX1vk1M+6mBUwC/uXf v4z1xtTU3soQW3AOzwXFm0wpCfISLGbW7RQw+rdeZ5CkPv+cMKL+MbFbm1z68rEwB70Q bdPasCF9IRpogTWzhiFpSq63n2InFjaOdY0EoahAQqpxG9dNzqpYA0ufbnuPHD1FygS6 JmiivTT6ugXq3FNjdrg+9RtkobFzXtKD9kGIgEamI8FnwNQ6M+RlEpbo6Op/e04AXyCQ 5063xcAycXZ26IjXgEoEBC0/IWr9i3HKHfdDL+favsLsHaGqZCPfcqB2BK7xmwSOd1x2 s3uw== X-Gm-Message-State: AOUpUlFYNJbfzzvERy1QrEQr8fsGzqMKSWPNooTqkIloVxzG1+J8bK5/ 744+Uvu6/LUou8xvcyrQd0sCM0Vk/qk= X-Received: by 2002:a19:4c57:: with SMTP id z84-v6mr4917876lfa.67.1531488949475; Fri, 13 Jul 2018 06:35:49 -0700 (PDT) Received: from localhost ([195.238.92.132]) by smtp.gmail.com with ESMTPSA id i65-v6sm2920503lji.88.2018.07.13.06.35.48 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 13 Jul 2018 06:35:48 -0700 (PDT) From: Sam Protsenko To: u-boot@lists.denx.de Date: Fri, 13 Jul 2018 16:35:45 +0300 Message-Id: <20180713133547.21094-1-semen.protsenko@linaro.org> X-Mailer: git-send-email 2.18.0 Cc: Tom Rini Subject: [U-Boot] [PATCH v2 1/3] dfu: Fix data abort in dfu_free_entities() X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" Commit 5d8fae79163e ("dfu: avoid memory leak") brings a regression which described below. This patch is effectively reverting that commit, adding corresponding comment to avoid such regressions in future. In case of error in dfu_config_entities(), it frees "dfu" array, which leads to "data abort" in dfu_free_entities(), which tries to free the same array (and even tries to access it from linked list first). The issue occurs e.g. when partition table on device does not match $dfu_alt_info layout: => dfu 0 mmc 1 Couldn't find part #2 on mmc device #1 DFU entities configuration failed! data abort To fix this issue, do not free "dfu" array in dfu_config_entities(). It will be freed later in dfu_free_entities(). Tested on BeagleBone Black (where this regression was originally found). Signed-off-by: Sam Protsenko --- Changes in v2: - Improve commit message by mentioning regression commit drivers/dfu/dfu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index e7c91193b9..a3c09334b7 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, devstr); if (ret) { - free(dfu); + /* We will free "dfu" in dfu_free_entities() */ return -1; }