[U-Boot] [PATCH v2 1/3] dfu: Fix data abort in dfu_free_entities()

[U-Boot] [PATCH v2 1/3] dfu: Fix data abort in dfu_free_entities()

[Sam Protsenko]

Commit 5d8fae79163e ("dfu: avoid memory leak") brings a regression which
described below. This patch is effectively reverting that commit, adding
corresponding comment to avoid such regressions in future.

In case of error in dfu_config_entities(), it frees "dfu" array, which
leads to "data abort" in dfu_free_entities(), which tries to free the
same array (and even tries to access it from linked list first). The
issue occurs e.g. when partition table on device does not match
$dfu_alt_info layout:

    => dfu 0 mmc 1
    Couldn't find part #2 on mmc device #1
    DFU entities configuration failed!
    data abort

To fix this issue, do not free "dfu" array in dfu_config_entities(). It
will be freed later in dfu_free_entities().

Tested on BeagleBone Black (where this regression was originally found).

Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
---
Changes in v2:
  - Improve commit message by mentioning regression commit

 drivers/dfu/dfu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index e7c91193b9..a3c09334b7 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
 		ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
 				      devstr);
 		if (ret) {
-			free(dfu);
+			/* We will free "dfu" in dfu_free_entities() */
 			return -1;
 		}
 
-- 
2.18.0

[U-Boot] [PATCH v2 2/3] dfu: Fix memory leak in dfu_init_env_entities()

[Sam Protsenko]

In case of error in dfu_init_env_entities(), env_bkp will leak. Fix it
by providing single return path.

Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
---
Changes in v2:
  - None

 drivers/dfu/dfu.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index a3c09334b7..5b9abd685d 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -56,7 +56,7 @@ int dfu_init_env_entities(char *interface, char *devstr)
 {
 	const char *str_env;
 	char *env_bkp;
-	int ret;
+	int ret = 0;
 
 #ifdef CONFIG_SET_DFU_ALT_INFO
 	set_dfu_alt_info(interface, devstr);
@@ -71,11 +71,12 @@ int dfu_init_env_entities(char *interface, char *devstr)
 	ret = dfu_config_entities(env_bkp, interface, devstr);
 	if (ret) {
 		pr_err("DFU entities configuration failed!\n");
-		return ret;
+		goto done;
 	}
 
+done:
 	free(env_bkp);
-	return 0;
+	return ret;
 }
 
 static unsigned char *dfu_buf;
-- 
2.18.0

[U-Boot] [PATCH v2 3/3] dfu: Provide more verbose error message

[Sam Protsenko]

It might be useful for user to see some human-readable root cause
message in addition to "configuration failed" message, so that the issue
can be fixed quickly.

Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
---
Changes in v2:
  - None

 drivers/dfu/dfu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index 5b9abd685d..318949529b 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -71,6 +71,7 @@ int dfu_init_env_entities(char *interface, char *devstr)
 	ret = dfu_config_entities(env_bkp, interface, devstr);
 	if (ret) {
 		pr_err("DFU entities configuration failed!\n");
+		pr_err("(partition table does not match dfu_alt_info?)\n");
 		goto done;
 	}
 
-- 
2.18.0

[U-Boot] [PATCH v2 1/3] dfu: Fix data abort in dfu_free_entities()

[Sam Protsenko]

On Fri, Jul 13, 2018 at 4:35 PM, Sam Protsenko
<semen.protsenko@linaro.org> wrote:
> Commit 5d8fae79163e ("dfu: avoid memory leak") brings a regression which
> described below. This patch is effectively reverting that commit, adding
> corresponding comment to avoid such regressions in future.
>
> In case of error in dfu_config_entities(), it frees "dfu" array, which
> leads to "data abort" in dfu_free_entities(), which tries to free the
> same array (and even tries to access it from linked list first). The
> issue occurs e.g. when partition table on device does not match
> $dfu_alt_info layout:
>
>     => dfu 0 mmc 1
>     Couldn't find part #2 on mmc device #1
>     DFU entities configuration failed!
>     data abort
>
> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
> will be freed later in dfu_free_entities().
>
> Tested on BeagleBone Black (where this regression was originally found).
>
> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> ---
> Changes in v2:
>   - Improve commit message by mentioning regression commit
>

Hi Lukasz,

Can you please review and merge this whole series?

Thanks!

>  drivers/dfu/dfu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index e7c91193b9..a3c09334b7 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
>                 ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
>                                       devstr);
>                 if (ret) {
> -                       free(dfu);
> +                       /* We will free "dfu" in dfu_free_entities() */
>                         return -1;
>                 }
>
> --
> 2.18.0
>

[U-Boot] [PATCH v2 1/3] dfu: Fix data abort in dfu_free_entities()

[Lukasz Majewski]

Hi Sam,

> On Fri, Jul 13, 2018 at 4:35 PM, Sam Protsenko
> <semen.protsenko@linaro.org> wrote:
> > Commit 5d8fae79163e ("dfu: avoid memory leak") brings a regression
> > which described below. This patch is effectively reverting that
> > commit, adding corresponding comment to avoid such regressions in
> > future.
> >
> > In case of error in dfu_config_entities(), it frees "dfu" array,
> > which leads to "data abort" in dfu_free_entities(), which tries to
> > free the same array (and even tries to access it from linked list
> > first). The issue occurs e.g. when partition table on device does
> > not match $dfu_alt_info layout:
> >  
> >     => dfu 0 mmc 1  
> >     Couldn't find part #2 on mmc device #1
> >     DFU entities configuration failed!
> >     data abort
> >
> > To fix this issue, do not free "dfu" array in
> > dfu_config_entities(). It will be freed later in
> > dfu_free_entities().
> >
> > Tested on BeagleBone Black (where this regression was originally
> > found).
> >
> > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> > ---
> > Changes in v2:
> >   - Improve commit message by mentioning regression commit
> >  
> 
> Hi Lukasz,
> 
> Can you please review and merge this whole series?

This has been already included:

http://git.denx.de/?p=u-boot/u-boot-dfu.git;a=shortlog;h=refs/heads/master

Marek has fetch this tree and will send PR soon.

> 
> Thanks!
> 
> >  drivers/dfu/dfu.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> > index e7c91193b9..a3c09334b7 100644
> > --- a/drivers/dfu/dfu.c
> > +++ b/drivers/dfu/dfu.c
> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char
> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,
> > alt_num_cnt, interface, devstr);
> >                 if (ret) {
> > -                       free(dfu);
> > +                       /* We will free "dfu" in
> > dfu_free_entities() */ return -1;
> >                 }
> >
> > --
> > 2.18.0
> >  




Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20180724/64197372/attachment.sig>