From 4ec6c5cabbcb503692ee469413d03a58247c3129 Mon Sep 17 00:00:00 2001
From: SPRESENSE <41312067+SPRESENSE@users.noreply.github.com>
Date: Fri, 22 Jul 2022 23:10:47 +0900
Subject: [PATCH] binfmt: Fix memory leak in ELF loader

Summary:
- I noticed that the hello (ELF) application causes a memory leak.
- Finally, I found that the data section is not deallocated.
- This commit fixes this issue.

Impact:
- ELF loader with CONFIG_ARCH_ADDRENV=n

Testing:
- Tested with the following configs
  - sprensense:elf, esp32-devkitc:elf, sabre-6quad:elf
  - spresense:wifi_smp, rv-virt:nsh64, sabre-6quad:netnsh

Signed-off-by: Masayuki Ishikawa <Masayuki.Ishikawa@jp.sony.com>
---
 binfmt/binfmt_unloadmodule.c  | 11 ++++++++---
 binfmt/elf.c                  |  5 +++--
 include/nuttx/binfmt/binfmt.h |  2 +-
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/binfmt/binfmt_unloadmodule.c b/binfmt/binfmt_unloadmodule.c
index e9b44555e7e..801bb79d20f 100644
--- a/binfmt/binfmt_unloadmodule.c
+++ b/binfmt/binfmt_unloadmodule.c
@@ -167,10 +167,15 @@ int unload_module(FAR struct binary_s *binp)
             {
               binfo("Freeing alloc[%d]: %p\n", i, binp->alloc[i]);
 #if defined(CONFIG_ARCH_USE_TEXT_HEAP)
-              up_textheap_free((FAR void *)binp->alloc[i]);
-#else
-              kumm_free((FAR void *)binp->alloc[i]);
+              if (i == 0)
+                {
+                  up_textheap_free((FAR void *)binp->alloc[i]);
+                }
+              else
 #endif
+                {
+                  kumm_free((FAR void *)binp->alloc[i]);
+                }
             }
         }
 
diff --git a/binfmt/elf.c b/binfmt/elf.c
index fd99c3d58ae..8046fb88ae7 100644
--- a/binfmt/elf.c
+++ b/binfmt/elf.c
@@ -268,9 +268,10 @@ static int elf_loadbinary(FAR struct binary_s *binp,
   up_addrenv_clone(&loadinfo.addrenv, &binp->addrenv);
 #else
   binp->alloc[0]  = (FAR void *)loadinfo.textalloc;
+  binp->alloc[1]  = (FAR void *)loadinfo.dataalloc;
 #ifdef CONFIG_BINFMT_CONSTRUCTORS
-  binp->alloc[1]  = loadinfo.ctoralloc;
-  binp->alloc[2]  = loadinfo.dtoralloc;
+  binp->alloc[2]  = loadinfo.ctoralloc;
+  binp->alloc[3]  = loadinfo.dtoralloc;
 #endif
 #endif
 
diff --git a/include/nuttx/binfmt/binfmt.h b/include/nuttx/binfmt/binfmt.h
index e49a80f4eaa..d03c4842720 100644
--- a/include/nuttx/binfmt/binfmt.h
+++ b/include/nuttx/binfmt/binfmt.h
@@ -38,7 +38,7 @@
  * Pre-processor Definitions
  ****************************************************************************/
 
-#define BINFMT_NALLOC 3
+#define BINFMT_NALLOC 4
 
 /****************************************************************************
  * Public Types