MfgTool for i.MX508, UTP NULL pointer dereference during extracting files

[mlite]

I am currently working on MfgTool for i.MX508, and I found the MfgTool for my board is not stable as we expected, sometimes (80%) the g_file_storage reports NULL pointer dereference for this command:

<CMD type="push" body="pipe tar -jxv -C /mnt/mmcblk0p1" file="files/rootfs.tar.bz2">Sending and writting rootfs</CMD>

I debugged the kernel (I am using L2.6.35.3_11.05.01, and found in source file: fsl_updater.c, line 421:

 if (!list_empty(&ctx->write)) {
  uud = list_first_entry(&ctx->write, struct utp_user_data, link);

The uud is used without checking its validity, so kernel crashes.

I didn't dig much more because I am busy for now, hope somebody can look into this. I will turn to this issue later.

[mlite]

Below is the kernel log, if someone has interest in it:

usr/bin/tty
usr/bin/logname
usr/bin/locale
Unable to handle kernel NULL pointer dereference at virtual address 00000009
pgd = 80004000
[00000009] *pgd=00000000
Internal error: Oops: 17 [#1] PREEMPT
last sysfs file: /sys/devices/platform/mxsdhci.2/mmc_host/mmc0/mmc0:0001/boot_bus_config
Modules linked in:
CPU: 0    Not tainted  (2.6.35.3-998-ga1cd8a7+ #15)
PC is at fsg_main_thread+0xafc/0x2400
LR is at fsg_main_thread+0xafc/0x2400
pc : [<801b0998>]    lr : [<801b0998>]    psr: 60000013
sp : 870fff18  ip : 00000000  fp : 00000086
r10: 000000a2  r9 : 00000000  r8 : 00000000
r7 : 8061de78  r6 : 870fe000  r5 : 80650040  r4 : 870e2c40
r3 : 00000000  r2 : 00000000  r1 : 00000001  r0 : 80650050
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c5387d  Table: 77e84019  DAC: 00000017
Process file-storage-ga (pid: 362, stack limit = 0x870fe2e8)
Stack: (0x870fff18 to 0x87100000)
ff00:                                                       870e2c9c 805bdc3e
ff20: 870fff44 00000003 870e2cf7 870e2cf8 87ac9c50 80606c18 80650050 862a4300
ff40: 870e2cf9 870e2cf6 870e2cf2 870e2cf5 870e2cf4 870e2cf3 870e2c80 870e2cf0
ff60: 00000000 870e2c44 00000000 00000000 87ac9c20 870fff98 870e2cfb 870e2cfc
ff80: 870e2cfd 870e2cfa 80606c58 00000000 87ac9c20 800589d0 870fff98 870fff98
ffa0: 870fffcc 8026dc80 00000000 8700df20 870fffd4 801afe9c 870e2c40 00000000
ffc0: 00000000 00000000 00000000 8005869c 00000000 00000000 870fffd8 870fffd8
ffe0: 00000000 8700df20 80058624 8001f8e0 00000013 8001f8e0 6ce4cc33 6ce4cc33
[<801b0998>] (fsg_main_thread+0xafc/0x2400) from [<8005869c>] (kthread+0x78/0x80)
[<8005869c>] (kthread+0x78/0x80) from [<8001f8e0>] (kernel_thread_exit+0x0/0x8)
Code: e1818c0e e1530008 03a08000 eb02f7e5 (e5d80009)
---[ end trace 01f3d86c7ee376e7 ]---