On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko semen.protsenko@linaro.org wrote:
The story of this change goes further... Just checked the reason, the bug was introduced here [1]. So we can either use my patch (which adds corresponding comment to ensure we won't "fix" it later), or the whole design of dfu_config_entities() vs dfu_free_entities() should be revised.
Effectively you are reverting that commit, perhaps make it clear in commit message that this is a revert.
Lukasz, what do you think about this?
[1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48c...
On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko semen.protsenko@linaro.org wrote:
In case of error in dfu_config_entities(), it frees "dfu" array, which leads to "data abort" in dfu_free_entities(), which tries to free the same array (and even tries to access it from linked list first). The issue occurs e.g. when partition table on device does not match $dfu_alt_info layout:
=> dfu 0 mmc 1 list Couldn't find part #2 on mmc device #1 DFU entities configuration failed! data abortTo fix this issue, do not free "dfu" array in dfu_config_entities(). It will be freed later in dfu_free_entities().
Signed-off-by: Sam Protsenko semen.protsenko@linaro.org
drivers/dfu/dfu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index e7c91193b9..a3c09334b7 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, devstr); if (ret) {
free(dfu);
/* We will free "dfu" in dfu_free_entities() */ return -1; }-- 2.18.0
U-Boot mailing list U-Boot@lists.denx.de https://lists.denx.de/listinfo/u-boot