[U-Boot] Issue in drivers/mmc/mmc.c
There appears to be a path through mmc_read in drivers/mmc/mmc.c where malloc'd memory is not freed before exiting mmc_read, although this may be a hypothetical situation. It occurs if mmc_set_blocklen() returns a non-zero value.
The following patch appears to resolve the issue:
--- o/drivers/mmc/mmc.c 2010-01-03 00:44:41.000000000 +0000 +++ drivers/mmc/mmc.c 2010-01-03 00:46:14.000000000 +0000 @@ -172,7 +172,7 @@ int mmc_read(struct mmc *mmc, u64 src, u err = mmc_set_blocklen(mmc, mmc->read_bl_len);
if (err) - return err; + goto free_buffer;
for (i = startblock; i <= endblock; i++) { int segment_size;
Regards, Quentin Armitage
Dear Quentin Armitage,
In message 1262480450.2820.140.camel@samson.armitage.org.uk you wrote:
There appears to be a path through mmc_read in drivers/mmc/mmc.c where malloc'd memory is not freed before exiting mmc_read, although this may be a hypothetical situation. It occurs if mmc_set_blocklen() returns a non-zero value.
The following patch appears to resolve the issue:
--- o/drivers/mmc/mmc.c 2010-01-03 00:44:41.000000000 +0000 +++ drivers/mmc/mmc.c 2010-01-03 00:46:14.000000000 +0000 @@ -172,7 +172,7 @@ int mmc_read(struct mmc *mmc, u64 src, u err = mmc_set_blocklen(mmc, mmc->read_bl_len);
if (err)
return err;
goto free_buffer;for (i = startblock; i <= endblock; i++) { int segment_size;
Can you please resent this patch, with your Signed-off-by: line added?
See http://www.denx.de/wiki/U-Boot/Patches for details. Thanks.
Best regards,
Wolfgang Denk
Dear Quentin Armitage,
In message 1262480450.2820.140.camel@samson.armitage.org.uk you wrote:
There appears to be a path through mmc_read in drivers/mmc/mmc.c where malloc'd memory is not freed before exiting mmc_read, although this may be a hypothetical situation. It occurs if mmc_set_blocklen() returns a non-zero value.
The following patch appears to resolve the issue:
--- o/drivers/mmc/mmc.c 2010-01-03 00:44:41.000000000 +0000 +++ drivers/mmc/mmc.c 2010-01-03 00:46:14.000000000 +0000 @@ -172,7 +172,7 @@ int mmc_read(struct mmc *mmc, u64 src, u err = mmc_set_blocklen(mmc, mmc->read_bl_len);
if (err)
return err;
goto free_buffer;for (i = startblock; i <= endblock; i++) { int segment_size;
As you did not follow up on my request to repostwith you SoB-line added I went ahead and added the fix myself. Thanks for reporting it.
Best regards,
Wolfgang Denk
participants (2)
-
Quentin Armitage -
Wolfgang Denk