[PATCH] dfu: dfu_sf: avoid double free of SPI device

[PATCH] dfu: dfu_sf: avoid double free of SPI device

[Heinrich Schuchardt]

Multiple DFU entities may share the same SPI device. We must make sure that
the SPI device is only freed once.

When using the driver model it is not necessary to free the SPI device.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 drivers/dfu/dfu_sf.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/dfu/dfu_sf.c b/drivers/dfu/dfu_sf.c
index 76b629a334..8f8c425977 100644
--- a/drivers/dfu/dfu_sf.c
+++ b/drivers/dfu/dfu_sf.c
@@ -87,7 +87,23 @@ static unsigned int dfu_polltimeout_sf(struct dfu_entity *dfu)

 static void dfu_free_entity_sf(struct dfu_entity *dfu)
 {
-	spi_flash_free(dfu->data.sf.dev);
+	/*
+	 * In the DM case it is not necessary to free the SPI device.
+	 * For the non-DM case we must ensure that the the SPI device is only
+	 * freed once.
+	 */
+	if (!CONFIG_IS_ENABLED(DM_SPI_FLASH)) {
+		struct spi_flash *dev = dfu->data.sf.dev;
+
+		if (!dev)
+			return;
+		dfu->data.sf.dev = NULL;
+		list_for_each_entry(dfu, &dfu_list, list) {
+			if (dfu->data.sf.dev == dev)
+				dfu->data.sf.dev = NULL;
+		}
+		spi_flash_free(dev);
+	}
 }

 static struct spi_flash *parse_dev(char *devstr)
--
2.30.2

[PATCH] dfu: dfu_sf: avoid double free of SPI device

[Heinrich Schuchardt]

On 19.03.21 00:55, Heinrich Schuchardt wrote:
> Multiple DFU entities may share the same SPI device. We must make sure that
> the SPI device is only freed once.
>
> When using the driver model it is not necessary to free the SPI device.
>
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> ---
>  drivers/dfu/dfu_sf.c | 18 +++++++++++++++++-
>  1 file changed, 17 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/dfu/dfu_sf.c b/drivers/dfu/dfu_sf.c
> index 76b629a334..8f8c425977 100644
> --- a/drivers/dfu/dfu_sf.c
> +++ b/drivers/dfu/dfu_sf.c
> @@ -87,7 +87,23 @@ static unsigned int dfu_polltimeout_sf(struct dfu_entity *dfu)
>
>  static void dfu_free_entity_sf(struct dfu_entity *dfu)
>  {
> -	spi_flash_free(dfu->data.sf.dev);
> +	/*
> +	 * In the DM case it is not necessary to free the SPI device.
> +	 * For the non-DM case we must ensure that the the SPI device is only
> +	 * freed once.
> +	 */
> +	if (!CONFIG_IS_ENABLED(DM_SPI_FLASH)) {
> +		struct spi_flash *dev = dfu->data.sf.dev;
> +
> +		if (!dev)
> +			return;
> +		dfu->data.sf.dev = NULL;
> +		list_for_each_entry(dfu, &dfu_list, list) {
> +			if (dfu->data.sf.dev == dev)
> +				dfu->data.sf.dev = NULL;
> +		}
> +		spi_flash_free(dev);
> +	}
>  }
>
>  static struct spi_flash *parse_dev(char *devstr)
> --
> 2.30.2
>
Dear Lukasz,

fixing the reported issue is prerequisite for merging a patch series by
Jose.

Could you, please, provide for feedback this patch.

Best regards

Heinrich

[PATCH] dfu: dfu_sf: avoid double free of SPI device

[Lukasz Majewski]

On Wed, 24 Mar 2021 18:21:37 +0100
Heinrich Schuchardt <xypron.debian@gmx.de> wrote:

> On 19.03.21 00:55, Heinrich Schuchardt wrote:
> > Multiple DFU entities may share the same SPI device. We must make
> > sure that the SPI device is only freed once.
> >
> > When using the driver model it is not necessary to free the SPI
> > device.
> >
> > Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
> > ---
> >  drivers/dfu/dfu_sf.c | 18 +++++++++++++++++-
> >  1 file changed, 17 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/dfu/dfu_sf.c b/drivers/dfu/dfu_sf.c
> > index 76b629a334..8f8c425977 100644
> > --- a/drivers/dfu/dfu_sf.c
> > +++ b/drivers/dfu/dfu_sf.c
> > @@ -87,7 +87,23 @@ static unsigned int dfu_polltimeout_sf(struct
> > dfu_entity *dfu)
> >
> >  static void dfu_free_entity_sf(struct dfu_entity *dfu)
> >  {
> > -	spi_flash_free(dfu->data.sf.dev);
> > +	/*
> > +	 * In the DM case it is not necessary to free the SPI
> > device.
> > +	 * For the non-DM case we must ensure that the the SPI
> > device is only
> > +	 * freed once.
> > +	 */
> > +	if (!CONFIG_IS_ENABLED(DM_SPI_FLASH)) {
> > +		struct spi_flash *dev = dfu->data.sf.dev;
> > +
> > +		if (!dev)
> > +			return;
> > +		dfu->data.sf.dev = NULL;
> > +		list_for_each_entry(dfu, &dfu_list, list) {
> > +			if (dfu->data.sf.dev == dev)
> > +				dfu->data.sf.dev = NULL;
> > +		}
> > +		spi_flash_free(dev);
> > +	}
> >  }
> >
> >  static struct spi_flash *parse_dev(char *devstr)
> > --
> > 2.30.2
> >  
> Dear Lukasz,
> 
> fixing the reported issue is prerequisite for merging a patch series
> by Jose.
> 
> Could you, please, provide for feedback this patch.
> 
> Best regards
> 
> Heinrich

Acked-by: Lukasz Majewski <lukma@denx.de>


Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-59 Fax: (+49)-8142-66989-80 Email: lukma at denx.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20210325/0c3367b7/attachment.sig>