Syslinux - Jul 2010 - __free_tagged not freeing memory?

__free_tagged called by comboot_cleanup_lowmem (core/mem/free.c) doesn't
seem to work correctly. Memory allocated with lmalloc() isn't marked as free
after the allocating module exits:

boot: mem
lowmem_buf: 0x000353e0
boot: mem
lowmem_buf: 0x000553f0
boot: mem
lowmem_buf: 0x00075400
boot: mem
lowmem_buf: 0x00000000
boot:

The expected behaviour

boot: mem
lowmem_buf: 0x000353e0
boot: mem
lowmem_buf: 0x000353e0
boot: mem
lowmem_buf: 0x000353e0

can be achieved with the following patch.

Sebastian

diff --git a/core/mem/free.c b/core/mem/free.c
index 0becb9e..384f10e 100644
--- a/core/mem/free.c
+++ b/core/mem/free.c
@@ -136,7 +136,7 @@ static void __free_tagged(malloc_tag_t tag) {
     for (i = 0; i < NHEAP; i++) {
        dprintf("__free_tagged(%u) heap %d\n", tag, i);
        head = &__malloc_head[i];
-       for (fp = head ; fp != head ; fp = fp->a.next) {
+       for (fp = head->a.next ; fp != head ; fp = fp->a.next) {
            if (ARENA_TYPE_GET(fp->a.attrs) == ARENA_TYPE_USED &&
                fp->a.tag == tag)
                fp = __free_block(fp);