mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2025-10-01 18:51:33 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

dfu: Fix data abort in dfu_free_entities()

Browse Source 
Commit 5d8fae79163e ("dfu: avoid memory leak") brings a regression which
described below. This patch is effectively reverting that commit, adding
corresponding comment to avoid such regressions in future.

In case of error in dfu_config_entities(), it frees "dfu" array, which
leads to "data abort" in dfu_free_entities(), which tries to free the
same array (and even tries to access it from linked list first). The
issue occurs e.g. when partition table on device does not match
$dfu_alt_info layout:

    => dfu 0 mmc 1
    Couldn't find part #2 on mmc device #1
    DFU entities configuration failed!
    data abort

To fix this issue, do not free "dfu" array in dfu_config_entities(). It
will be freed later in dfu_free_entities().

Tested on BeagleBone Black (where this regression was originally found).

Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
This commit is contained in:
Sam Protsenko 2018-07-13 16:35:45 +03:00 committed by Marek Vasut
parent 92c7edae5e
commit feaa7856f5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/dfu/dfu.c
View File

@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface, ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
devstr); devstr);
if (ret) { if (ret) {
free(dfu); /* We will free "dfu" in dfu_free_entities() */
return -1; return -1;
} }