Hi Sam,

In case of error in dfu_init_env_entities(), env_bkp will leak. Fix it by providing single return path.

Signed-off-by: Sam Protsenko semen.protsenko@linaro.org

drivers/dfu/dfu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index a3c09334b7..5b9abd685d 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -56,7 +56,7 @@ int dfu_init_env_entities(char *interface, char *devstr) { const char *str_env; char *env_bkp;

• int ret;

• int ret = 0;

#ifdef CONFIG_SET_DFU_ALT_INFO set_dfu_alt_info(interface, devstr); @@ -71,11 +71,12 @@ int dfu_init_env_entities(char *interface, char *devstr) ret = dfu_config_entities(env_bkp, interface, devstr); if (ret) { pr_err("DFU entities configuration failed!\n");

• return ret;
  

• goto done;
  

  }

+done: free(env_bkp);

• return 0;

• return ret;

}

static unsigned char *dfu_buf;

Acked-by: Lukasz Majewski lukma@denx.de

Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd@denx.de

Hi Sam,

It might be useful for user to see some human-readable root cause message in addition to "configuration failed" message, so that the issue can be fixed quickly.

Signed-off-by: Sam Protsenko semen.protsenko@linaro.org

drivers/dfu/dfu.c | 1 + 1 file changed, 1 insertion(+)

diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index 5b9abd685d..318949529b 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -71,6 +71,7 @@ int dfu_init_env_entities(char *interface, char *devstr) ret = dfu_config_entities(env_bkp, interface, devstr); if (ret) { pr_err("DFU entities configuration failed!\n");

• pr_err("(partition table does not match
  

dfu_alt_info?)\n"); goto done; }

Acked-by: Lukasz Majewski lukma@denx.de

Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd@denx.de

On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko semen.protsenko@linaro.org wrote:

The story of this change goes further... Just checked the reason, the bug was introduced here [1]. So we can either use my patch (which adds corresponding comment to ensure we won't "fix" it later), or the whole design of dfu_config_entities() vs dfu_free_entities() should be revised.

Effectively you are reverting that commit, perhaps make it clear in commit message that this is a revert.

Lukasz, what do you think about this?

[1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48c...

On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko semen.protsenko@linaro.org wrote:

...

In case of error in dfu_config_entities(), it frees "dfu" array, which leads to "data abort" in dfu_free_entities(), which tries to free the same array (and even tries to access it from linked list first). The issue occurs e.g. when partition table on device does not match $dfu_alt_info layout:

=> dfu 0 mmc 1 list
Couldn't find part #2 on mmc device #1
DFU entities configuration failed!
data abort

To fix this issue, do not free "dfu" array in dfu_config_entities(). It will be freed later in dfu_free_entities().

Signed-off-by: Sam Protsenko semen.protsenko@linaro.org

drivers/dfu/dfu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index e7c91193b9..a3c09334b7 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, devstr); if (ret) {

•                   free(dfu);
  

•                   /* We will free "dfu" in dfu_free_entities() */
                    return -1;
            }
  
  

-- 2.18.0

---

U-Boot mailing list U-Boot@lists.denx.de https://lists.denx.de/listinfo/u-boot

Hi Sam,

The story of this change goes further... Just checked the reason, the bug was introduced here [1]. So we can either use my patch (which adds corresponding comment to ensure we won't "fix" it later), or the whole design of dfu_config_entities() vs dfu_free_entities() should be revised.

Lukasz, what do you think about this?

Your patch seems OK to me. I've checked all use cases and in the error path the dfu_free_entities() is called.

(Or have I misunderstood something) ?

[1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48c...

On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko semen.protsenko@linaro.org wrote:

...

In case of error in dfu_config_entities(), it frees "dfu" array, which leads to "data abort" in dfu_free_entities(), which tries to free the same array (and even tries to access it from linked list first). The issue occurs e.g. when partition table on device does not match $dfu_alt_info layout:

=> dfu 0 mmc 1 list  
Couldn't find part #2 on mmc device #1
DFU entities configuration failed!
data abort

To fix this issue, do not free "dfu" array in dfu_config_entities(). It will be freed later in dfu_free_entities().

Signed-off-by: Sam Protsenko semen.protsenko@linaro.org

drivers/dfu/dfu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c index e7c91193b9..a3c09334b7 100644 --- a/drivers/dfu/dfu.c +++ b/drivers/dfu/dfu.c @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, devstr); if (ret) {

•                   free(dfu);
  

•                   /* We will free "dfu" in
  

dfu_free_entities() */ return -1; }

-- 2.18.0

Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd@denx.de