[1/3] dfu: Fix data abort in dfu_free_entities()

Message ID 20180712215253.4290-1-semen.protsenko@linaro.org
State Superseded
Headers show
Series
  • [1/3] dfu: Fix data abort in dfu_free_entities()
Related show

Commit Message

Sam Protsenko July 12, 2018, 9:52 p.m.
In case of error in dfu_config_entities(), it frees "dfu" array, which
leads to "data abort" in dfu_free_entities(), which tries to free the
same array (and even tries to access it from linked list first). The
issue occurs e.g. when partition table on device does not match
$dfu_alt_info layout:

    => dfu 0 mmc 1 list
    Couldn't find part #2 on mmc device #1
    DFU entities configuration failed!
    data abort

To fix this issue, do not free "dfu" array in dfu_config_entities(). It
will be freed later in dfu_free_entities().

Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
---
 drivers/dfu/dfu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Sam Protsenko July 12, 2018, 10:10 p.m. | #1
The story of this change goes further... Just checked the reason, the
bug was introduced here [1]. So we can either use my patch (which adds
corresponding comment to ensure we won't "fix" it later), or the whole
design of dfu_config_entities() vs dfu_free_entities() should be
revised.

Lukasz, what do you think about this?

[1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba

On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
<semen.protsenko@linaro.org> wrote:
> In case of error in dfu_config_entities(), it frees "dfu" array, which
> leads to "data abort" in dfu_free_entities(), which tries to free the
> same array (and even tries to access it from linked list first). The
> issue occurs e.g. when partition table on device does not match
> $dfu_alt_info layout:
>
>     => dfu 0 mmc 1 list
>     Couldn't find part #2 on mmc device #1
>     DFU entities configuration failed!
>     data abort
>
> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
> will be freed later in dfu_free_entities().
>
> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
> ---
>  drivers/dfu/dfu.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index e7c91193b9..a3c09334b7 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
>                 ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
>                                       devstr);
>                 if (ret) {
> -                       free(dfu);
> +                       /* We will free "dfu" in dfu_free_entities() */
>                         return -1;
>                 }
>
> --
> 2.18.0
>
Andy Shevchenko July 13, 2018, 2:32 a.m. | #2
On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko
<semen.protsenko@linaro.org> wrote:
> The story of this change goes further... Just checked the reason, the
> bug was introduced here [1]. So we can either use my patch (which adds
> corresponding comment to ensure we won't "fix" it later), or the whole
> design of dfu_config_entities() vs dfu_free_entities() should be
> revised.

Effectively you are reverting that commit, perhaps make it clear in
commit message that this is a revert.

>
> Lukasz, what do you think about this?
>
> [1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>
> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
> <semen.protsenko@linaro.org> wrote:
>> In case of error in dfu_config_entities(), it frees "dfu" array, which
>> leads to "data abort" in dfu_free_entities(), which tries to free the
>> same array (and even tries to access it from linked list first). The
>> issue occurs e.g. when partition table on device does not match
>> $dfu_alt_info layout:
>>
>>     => dfu 0 mmc 1 list
>>     Couldn't find part #2 on mmc device #1
>>     DFU entities configuration failed!
>>     data abort
>>
>> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
>> will be freed later in dfu_free_entities().
>>
>> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
>> ---
>>  drivers/dfu/dfu.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
>> index e7c91193b9..a3c09334b7 100644
>> --- a/drivers/dfu/dfu.c
>> +++ b/drivers/dfu/dfu.c
>> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
>>                 ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
>>                                       devstr);
>>                 if (ret) {
>> -                       free(dfu);
>> +                       /* We will free "dfu" in dfu_free_entities() */
>>                         return -1;
>>                 }
>>
>> --
>> 2.18.0
>>
> _______________________________________________
> U-Boot mailing list
> U-Boot@lists.denx.de
> https://lists.denx.de/listinfo/u-boot
Lukasz Majewski July 13, 2018, 9:41 a.m. | #3
Hi Sam,

> In case of error in dfu_config_entities(), it frees "dfu" array, which

> leads to "data abort" in dfu_free_entities(), which tries to free the

> same array (and even tries to access it from linked list first). The

> issue occurs e.g. when partition table on device does not match

> $dfu_alt_info layout:

> 

>     => dfu 0 mmc 1 list  

>     Couldn't find part #2 on mmc device #1

>     DFU entities configuration failed!

>     data abort

> 

> To fix this issue, do not free "dfu" array in dfu_config_entities().

> It will be freed later in dfu_free_entities().

> 

> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>

> ---

>  drivers/dfu/dfu.c | 2 +-

>  1 file changed, 1 insertion(+), 1 deletion(-)

> 

> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c

> index e7c91193b9..a3c09334b7 100644

> --- a/drivers/dfu/dfu.c

> +++ b/drivers/dfu/dfu.c

> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char

> *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,

> alt_num_cnt, interface, devstr);

>  		if (ret) {

> -			free(dfu);

> +			/* We will free "dfu" in dfu_free_entities()

> */ return -1;

>  		}

>  


Thanks for catching it.

Acked-by: Lukasz Majewski <lukma@denx.de>


Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd@denx.de
Lukasz Majewski July 13, 2018, 9:49 a.m. | #4
Hi Sam,

> The story of this change goes further... Just checked the reason, the

> bug was introduced here [1]. So we can either use my patch (which adds

> corresponding comment to ensure we won't "fix" it later), or the whole

> design of dfu_config_entities() vs dfu_free_entities() should be

> revised.

> 

> Lukasz, what do you think about this?


Your patch seems OK to me. I've checked all use cases and in the error
path the dfu_free_entities() is called.


(Or have I misunderstood something) ?

> 

> [1]

> http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba

> 

> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko

> <semen.protsenko@linaro.org> wrote:

> > In case of error in dfu_config_entities(), it frees "dfu" array,

> > which leads to "data abort" in dfu_free_entities(), which tries to

> > free the same array (and even tries to access it from linked list

> > first). The issue occurs e.g. when partition table on device does

> > not match $dfu_alt_info layout:

> >  

> >     => dfu 0 mmc 1 list  

> >     Couldn't find part #2 on mmc device #1

> >     DFU entities configuration failed!

> >     data abort

> >

> > To fix this issue, do not free "dfu" array in

> > dfu_config_entities(). It will be freed later in

> > dfu_free_entities().

> >

> > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>

> > ---

> >  drivers/dfu/dfu.c | 2 +-

> >  1 file changed, 1 insertion(+), 1 deletion(-)

> >

> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c

> > index e7c91193b9..a3c09334b7 100644

> > --- a/drivers/dfu/dfu.c

> > +++ b/drivers/dfu/dfu.c

> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char

> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,

> > alt_num_cnt, interface, devstr);

> >                 if (ret) {

> > -                       free(dfu);

> > +                       /* We will free "dfu" in

> > dfu_free_entities() */ return -1;

> >                 }

> >

> > --

> > 2.18.0

> >  





Best regards,

Lukasz Majewski

--

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd@denx.de
Sam Protsenko July 13, 2018, 1:18 p.m. | #5
On Fri, Jul 13, 2018 at 5:32 AM, Andy Shevchenko
<andy.shevchenko@gmail.com> wrote:
> On Fri, Jul 13, 2018 at 1:10 AM, Sam Protsenko
> <semen.protsenko@linaro.org> wrote:
>> The story of this change goes further... Just checked the reason, the
>> bug was introduced here [1]. So we can either use my patch (which adds
>> corresponding comment to ensure we won't "fix" it later), or the whole
>> design of dfu_config_entities() vs dfu_free_entities() should be
>> revised.
>
> Effectively you are reverting that commit, perhaps make it clear in
> commit message that this is a revert.
>

Yeah, I just found that commit after sending my patch. Will add that
info in v2, thanks.

>>
>> Lukasz, what do you think about this?
>>
>> [1] http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>>
>> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
>> <semen.protsenko@linaro.org> wrote:
>>> In case of error in dfu_config_entities(), it frees "dfu" array, which
>>> leads to "data abort" in dfu_free_entities(), which tries to free the
>>> same array (and even tries to access it from linked list first). The
>>> issue occurs e.g. when partition table on device does not match
>>> $dfu_alt_info layout:
>>>
>>>     => dfu 0 mmc 1 list
>>>     Couldn't find part #2 on mmc device #1
>>>     DFU entities configuration failed!
>>>     data abort
>>>
>>> To fix this issue, do not free "dfu" array in dfu_config_entities(). It
>>> will be freed later in dfu_free_entities().
>>>
>>> Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
>>> ---
>>>  drivers/dfu/dfu.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
>>> index e7c91193b9..a3c09334b7 100644
>>> --- a/drivers/dfu/dfu.c
>>> +++ b/drivers/dfu/dfu.c
>>> @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char *interface, char *devstr)
>>>                 ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
>>>                                       devstr);
>>>                 if (ret) {
>>> -                       free(dfu);
>>> +                       /* We will free "dfu" in dfu_free_entities() */
>>>                         return -1;
>>>                 }
>>>
>>> --
>>> 2.18.0
>>>
>> _______________________________________________
>> U-Boot mailing list
>> U-Boot@lists.denx.de
>> https://lists.denx.de/listinfo/u-boot
>
>
>
> --
> With Best Regards,
> Andy Shevchenko
Sam Protsenko July 13, 2018, 1:28 p.m. | #6
Hi Lukasz,

On Fri, Jul 13, 2018 at 12:49 PM, Lukasz Majewski <lukma@denx.de> wrote:
> Hi Sam,
>
>> The story of this change goes further... Just checked the reason, the
>> bug was introduced here [1]. So we can either use my patch (which adds
>> corresponding comment to ensure we won't "fix" it later), or the whole
>> design of dfu_config_entities() vs dfu_free_entities() should be
>> revised.
>>
>> Lukasz, what do you think about this?
>
> Your patch seems OK to me. I've checked all use cases and in the error
> path the dfu_free_entities() is called.
>

The patch itself is ok. What I'm trying to say, is that design of
dfu_config_entities() is not very good. It allocates memory for "dfu"
array, and on error it doesn't free it, relying on dfu_free_entities()
to free it later. That's why Coverity reported it as a memory leak in
a first place (though it was false positive of course). But such a
design is not what user of the function usually expects. Better design
(as for my taste) would be if dfu_config_entities() cleans up
everything on error, so that even if user doesn't call
dfu_free_entities() after calling dfu_config_entities() (with return
on error), there is no memory leak involved. This way it would be
easier to control code flow, and Coverity will be happy too.

I suggest next: let's merge this patch as is (at least it makes things
work as originally intended), and if my thoughts on design make sense
to you, dfu_config_entities() can be reworked in further commits.
Sounds ok?

I will send v2 with improved commit message soon.

>
> (Or have I misunderstood something) ?
>
>>
>> [1]
>> http://git.denx.de/?p=u-boot.git;a=commit;h=5d8fae79163e94671956c99654abf48cf49757ba
>>
>> On Fri, Jul 13, 2018 at 12:52 AM, Sam Protsenko
>> <semen.protsenko@linaro.org> wrote:
>> > In case of error in dfu_config_entities(), it frees "dfu" array,
>> > which leads to "data abort" in dfu_free_entities(), which tries to
>> > free the same array (and even tries to access it from linked list
>> > first). The issue occurs e.g. when partition table on device does
>> > not match $dfu_alt_info layout:
>> >
>> >     => dfu 0 mmc 1 list
>> >     Couldn't find part #2 on mmc device #1
>> >     DFU entities configuration failed!
>> >     data abort
>> >
>> > To fix this issue, do not free "dfu" array in
>> > dfu_config_entities(). It will be freed later in
>> > dfu_free_entities().
>> >
>> > Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
>> > ---
>> >  drivers/dfu/dfu.c | 2 +-
>> >  1 file changed, 1 insertion(+), 1 deletion(-)
>> >
>> > diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
>> > index e7c91193b9..a3c09334b7 100644
>> > --- a/drivers/dfu/dfu.c
>> > +++ b/drivers/dfu/dfu.c
>> > @@ -462,7 +462,7 @@ int dfu_config_entities(char *env, char
>> > *interface, char *devstr) ret = dfu_fill_entity(&dfu[i], s,
>> > alt_num_cnt, interface, devstr);
>> >                 if (ret) {
>> > -                       free(dfu);
>> > +                       /* We will free "dfu" in
>> > dfu_free_entities() */ return -1;
>> >                 }
>> >
>> > --
>> > 2.18.0
>> >
>
>
>
>
> Best regards,
>
> Lukasz Majewski
>
> --
>
> DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
> HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
> Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd@denx.de

Patch

diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
index e7c91193b9..a3c09334b7 100644
--- a/drivers/dfu/dfu.c
+++ b/drivers/dfu/dfu.c
@@ -462,7 +462,7 @@  int dfu_config_entities(char *env, char *interface, char *devstr)
 		ret = dfu_fill_entity(&dfu[i], s, alt_num_cnt, interface,
 				      devstr);
 		if (ret) {
-			free(dfu);
+			/* We will free "dfu" in dfu_free_entities() */
 			return -1;
 		}