Hi Lukasz, On Fri, Jul 13, 2018 at 12:49 PM, Lukasz Majewski <lu...@denx.de> wrote: > Hi Sam, > >> The story of this change goes further... Just checked the reason, the >> bug was introduced here [1]. So we can either use my patch (which adds >> corresponding comment to ensure we won't "fix" it later), or the whole >> design of dfu_config_entities() vs dfu_free_entities() should be >> revised. >> >> Lukasz, what do you think about this? > > Your patch seems OK to me. I've checked all use cases and in the error > path the dfu_free_entities() is called. >
The patch itself is ok. What I'm trying to say, is that design of dfu_config_entities() is not very good. It allocates memory for "dfu" array, and on error it doesn't free it, relying on dfu_free_entities() to free it later. That's why Coverity reported it as a memory leak in a first place (though it was false positive of course). But such a design is not what user of the function usually expects. Better design (as for my taste) would be if dfu_config_entities() cleans up everything on error, so that even if user doesn't call dfu_free_entities() after calling dfu_config_entities() (with return on error), there is no memory leak involved. This way it would be easier to control code flow, and Coverity will be happy too. I suggest next: let's merge this patch as is (at least it makes things work as originally intended), and if my thoughts on design make sense to you, dfu_config_entities() can be reworked in further commits. Sounds ok? I will send v2 with improved commit message soon. > > (Or have I misunderstood something) ? > >> >> [1] >> http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba >> >> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko >> <semen.protse...@linaro.org> wrote: >> > In case of error in dfu_config_entities(), it frees "dfu" array, >> > which leads to "data abort" in dfu_free_entities(), which tries to >> > free the same array (and even tries to access it from linked list >> > first). The issue occurs e.g. when partition table on device does >> > not match $dfu_alt_info layout: >> > >> > => dfu 0 mmc 1 list >> > Couldn't find part #2 on mmc device #1 >> > DFU entities configuration failed! >> > data abort >> > >> > To fix this issue, do not free "dfu" array in >> > dfu_config_entities(). It will be freed later in >> > dfu_free_entities(). >> > >> > Signed-off-by: Sam Protsenko <semen.protse...@linaro.org> >> > --- >> > drivers/dfu/dfu.c | 2 +- >> > 1 file changed, 1 insertion(+), 1 deletion(-) >> > >> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c >> > index e7c91193b9..a3c09334b7 100644 >> > --- a/drivers/dfu/dfu.c >> > +++ b/drivers/dfu/dfu.c >> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char >> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s, >> > alt_num_cnt, interface, devstr); >> > if (ret) { >> > - free(dfu); >> > + /* We will free "dfu" in >> > dfu_free_entities() */ return -1; >> > } >> > >> > -- >> > 2.18.0 >> > > > > > > Best regards, > > Lukasz Majewski > > -- > > DENX Software Engineering GmbH, Managing Director: Wolfgang Denk > HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany > Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: w...@denx.de _______________________________________________ U-Boot mailing list U-Boot@lists.denx.de https://lists.denx.de/listinfo/u-boot
