[U-Boot] [PATCH 1/3] dfu: Fix data abort in dfu_free_entities()

[Lukasz Majewski <lukma@denx.de>]

Hi Sam,

> In case of error in dfu_config_entities(), it frees "dfu" array, which
> leads to "data abort" in dfu_free_entities(), which tries to free the
> same array (and even tries to access it from linked list first). The
> issue occurs e.g. when partition table on device does not match
> $dfu_alt_info layout:
> 
>     => dfu 0 mmc 1 list  
>     Couldn't find part #2 on mmc device #1
>     DFU entities configuration failed!
>     data abort
> 
> To fix this issue, do not free "dfu" array in dfu_config_entities().
> It will be freed later in dfu_free_entities().
> 
> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> ---
>  drivers/dfu/dfu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index e7c91193b9..a3c09334b7 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char
> *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,
> alt_num_cnt, interface, devstr);
>  		if (ret) {
> -			free(dfu);
> +			/* We will free "dfu" in dfu_free_entities()
> */ return -1;
>  		}
>  

Thanks for catching it.

Acked-by: Lukasz Majewski <lukma@denx.de>

Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180713/8c4bfe64/attachment.sig>