In case of error in dfu_config_entities(), it frees "dfu" array, which
leads to "data abort" in dfu_free_entities(), which tries to free the
same array (and even tries to access it from linked list first). The
issue occurs e.g. when partition table on device does not match
$dfu_alt_info layout:
=> dfu 0 mmc 1 list
Couldn't find part #2 on mmc device #1
DFU entities configuration failed!
data abort
To fix this issue, do not free "dfu" array in dfu_config_entities(). It
will be freed later in dfu_free_entities().
Signed-off-by: Sam Protsenko <semen.protse...@linaro.org>
---
drivers/dfu/dfu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index e7c91193b9..a3c09334b7 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char
*devstr)
ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
devstr);
if (ret) {
- free(dfu);
+ /* We will free "dfu" in dfu_free_entities() */
return -1;
}
--
2.18.0
_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
https://lists.denx.de/listinfo/u-boot
