Module Name: src
Committed By: martin
Date: Fri Aug 22 10:15:22 UTC 2014
Modified Files:
src/sys/altq [netbsd-7]: altq_jobs.c
src/sys/dev/ic [netbsd-7]: oosiop.c
src/sys/dev/qbus [netbsd-7]: if_qe.c
src/sys/dev/rasops [netbsd-7]: rasops.c
src/sys/dev/vme [netbsd-7]: if_ie_vme.c
src/sys/net [netbsd-7]: if_gre.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #44):
sys/altq/altq_jobs.c 1.7
Fix error branches to avoid leaks, noted by maxv@.
sys/dev/ic/oosiop.c 1.14
Fix leaks in oosiop_alloc_cb error branches, noted by maxv@.
While here, avoid a sketchy pointer cast that probably falls afoul
of strict aliasing rules.
sys/dev/qbus/if_qe.c 1.73
Avoid leak in error branch, noted by maxv@, compile-tested for vax.
sys/dev/rasops/rasops.c 1.72
Don't leak f on failure. Noted by maxv@.
sys/dev/vme/if_ie_vme.c 1.31
Sizeof struct ievme, not sizeof size_t.
Noted by maxv@, compile-tested for sparc.
sys/net/if_gre.c 1.160
Don't leak in gre_clone_create error branch.
Noted by maxv@, compile-tested for amd64.
To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.6.34.1 src/sys/altq/altq_jobs.c
cvs rdiff -u -r1.13 -r1.13.34.1 src/sys/dev/ic/oosiop.c
cvs rdiff -u -r1.72 -r1.72.4.1 src/sys/dev/qbus/if_qe.c
cvs rdiff -u -r1.71 -r1.71.14.1 src/sys/dev/rasops/rasops.c
cvs rdiff -u -r1.30 -r1.30.28.1 src/sys/dev/vme/if_ie_vme.c
cvs rdiff -u -r1.159 -r1.159.2.1 src/sys/net/if_gre.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/altq/altq_jobs.c
diff -u src/sys/altq/altq_jobs.c:1.6 src/sys/altq/altq_jobs.c:1.6.34.1
--- src/sys/altq/altq_jobs.c:1.6 Fri Apr 9 19:32:45 2010
+++ src/sys/altq/altq_jobs.c Fri Aug 22 10:15:22 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: altq_jobs.c,v 1.6 2010/04/09 19:32:45 plunky Exp $ */
+/* $NetBSD: altq_jobs.c,v 1.6.34.1 2014/08/22 10:15:22 martin Exp $ */
/* $KAME: altq_jobs.c,v 1.11 2005/04/13 03:44:25 suz Exp $ */
/*
* Copyright (c) 2001, the Rector and Board of Visitors of the
@@ -59,7 +59,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: altq_jobs.c,v 1.6 2010/04/09 19:32:45 plunky Exp $");
+__KERNEL_RCSID(0, "$NetBSD: altq_jobs.c,v 1.6.34.1 2014/08/22 10:15:22 martin Exp $");
#ifdef _KERNEL_OPT
#include "opt_altq.h"
@@ -1158,7 +1158,7 @@ adjust_rates_rdc(struct jobs_if *jif)
error = update_error(jif);
if (!error)
- return (NULL);
+ goto fail;
prop_control = (upper_bound*upper_bound*min_share)
/(max_prod*(max_avg_pkt_size << 2));
@@ -1252,6 +1252,9 @@ adjust_rates_rdc(struct jobs_if *jif)
}
}
return result;
+
+fail: free(result, M_DEVBUF);
+ return NULL;
}
/*
@@ -1284,19 +1287,19 @@ assign_rate_drops_adc(struct jobs_if *ji
result = malloc((jif->jif_maxpri+1)*sizeof(int64_t), M_DEVBUF, M_WAITOK);
if (result == NULL)
- return NULL;
+ goto fail0;
c = malloc((jif->jif_maxpri+1)*sizeof(u_int64_t), M_DEVBUF, M_WAITOK);
if (c == NULL)
- return NULL;
+ goto fail1;
n = malloc((jif->jif_maxpri+1)*sizeof(u_int64_t), M_DEVBUF, M_WAITOK);
if (n == NULL)
- return NULL;
+ goto fail2;
k = malloc((jif->jif_maxpri+1)*sizeof(u_int64_t), M_DEVBUF, M_WAITOK);
if (k == NULL)
- return NULL;
+ goto fail3;
available = malloc((jif->jif_maxpri+1)*sizeof(int64_t), M_DEVBUF, M_WAITOK);
if (available == NULL)
- return NULL;
+ goto fail4;
for (i = 0; i <= jif->jif_maxpri; i++)
result[i] = 0;
@@ -1525,6 +1528,14 @@ assign_rate_drops_adc(struct jobs_if *ji
free(available, M_DEVBUF);
return (result);
+
+fail5: __unused
+ free(available, M_DEVBUF);
+fail4: free(k, M_DEVBUF);
+fail3: free(n, M_DEVBUF);
+fail2: free(c, M_DEVBUF);
+fail1: free(result, M_DEVBUF);
+fail0: return NULL;
}
/*
Index: src/sys/dev/ic/oosiop.c
diff -u src/sys/dev/ic/oosiop.c:1.13 src/sys/dev/ic/oosiop.c:1.13.34.1
--- src/sys/dev/ic/oosiop.c:1.13 Sat Nov 13 13:52:02 2010
+++ src/sys/dev/ic/oosiop.c Fri Aug 22 10:15:22 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: oosiop.c,v 1.13 2010/11/13 13:52:02 uebayasi Exp $ */
+/* $NetBSD: oosiop.c,v 1.13.34.1 2014/08/22 10:15:22 martin Exp $ */
/*
* Copyright (c) 2001 Shuichiro URATA. All rights reserved.
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: oosiop.c,v 1.13 2010/11/13 13:52:02 uebayasi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: oosiop.c,v 1.13.34.1 2014/08/22 10:15:22 martin Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -247,6 +247,7 @@ static int
oosiop_alloc_cb(struct oosiop_softc *sc, int ncb)
{
struct oosiop_cb *cb;
+ void *xfer_kva;
struct oosiop_xfer *xfer;
bus_size_t xfersize;
bus_dma_segment_t seg;
@@ -258,7 +259,8 @@ oosiop_alloc_cb(struct oosiop_softc *sc,
cb = malloc(sizeof(struct oosiop_cb) * ncb, M_DEVBUF, M_NOWAIT|M_ZERO);
if (cb == NULL) {
printf(": failed to allocate cb memory\n");
- return (ENOMEM);
+ err = ENOMEM;
+ goto fail0;
}
/*
@@ -269,57 +271,79 @@ oosiop_alloc_cb(struct oosiop_softc *sc,
&nseg, BUS_DMA_NOWAIT);
if (err) {
printf(": failed to allocate xfer block memory, err=%d\n", err);
- return (err);
+ goto fail1;
}
- err = bus_dmamem_map(sc->sc_dmat, &seg, nseg, xfersize,
- (void **)(void *)&xfer, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
+ KASSERT(nseg == 1);
+ err = bus_dmamem_map(sc->sc_dmat, &seg, nseg, xfersize, &xfer_kva,
+ BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
if (err) {
printf(": failed to map xfer block memory, err=%d\n", err);
- return (err);
+ goto fail2;
}
+ xfer = xfer_kva;
/* Initialize each command block */
for (i = 0; i < ncb; i++) {
err = bus_dmamap_create(sc->sc_dmat, PAGE_SIZE, 1, PAGE_SIZE,
- 0, BUS_DMA_NOWAIT, &cb->cmddma);
+ 0, BUS_DMA_NOWAIT, &cb[i].cmddma);
if (err) {
printf(": failed to create cmddma map, err=%d\n", err);
- return (err);
+ goto loop_fail0;
}
err = bus_dmamap_create(sc->sc_dmat, OOSIOP_MAX_XFER,
OOSIOP_NSG, OOSIOP_DBC_MAX, 0, BUS_DMA_NOWAIT,
- &cb->datadma);
+ &cb[i].datadma);
if (err) {
printf(": failed to create datadma map, err=%d\n", err);
- return (err);
+ goto loop_fail1;
}
err = bus_dmamap_create(sc->sc_dmat,
sizeof(struct oosiop_xfer), 1, sizeof(struct oosiop_xfer),
- 0, BUS_DMA_NOWAIT, &cb->xferdma);
+ 0, BUS_DMA_NOWAIT, &cb[i].xferdma);
if (err) {
printf(": failed to create xfer block map, err=%d\n",
err);
- return (err);
+ goto loop_fail2;
}
- err = bus_dmamap_load(sc->sc_dmat, cb->xferdma, xfer,
+ err = bus_dmamap_load(sc->sc_dmat, cb[i].xferdma, xfer,
sizeof(struct oosiop_xfer), NULL, BUS_DMA_NOWAIT);
if (err) {
printf(": failed to load xfer block, err=%d\n", err);
- return (err);
+ goto loop_fail3;
}
- cb->xfer = xfer;
+ cb[i].xfer = &xfer[i];
+ continue;
+loop_fail4: __unused
+ bus_dmamap_unload(sc->sc_dmat, cb[i].xferdma);
+loop_fail3: bus_dmamap_destroy(sc->sc_dmat, cb[i].xferdma);
+loop_fail2: bus_dmamap_destroy(sc->sc_dmat, cb[i].datadma);
+loop_fail1: bus_dmamap_destroy(sc->sc_dmat, cb[i].cmddma);
+loop_fail0: goto fail3;
+ }
+
+ for (i = 0; i < ncb; i++) {
s = splbio();
- TAILQ_INSERT_TAIL(&sc->sc_free_cb, cb, chain);
+ TAILQ_INSERT_TAIL(&sc->sc_free_cb, &cb[i], chain);
splx(s);
-
- cb++;
- xfer++;
}
- return (0);
+ /* Success! */
+ return 0;
+
+fail3: while (i--) {
+ bus_dmamap_unload(sc->sc_dmat, cb[i].xferdma);
+ bus_dmamap_destroy(sc->sc_dmat, cb[i].xferdma);
+ bus_dmamap_destroy(sc->sc_dmat, cb[i].datadma);
+ bus_dmamap_destroy(sc->sc_dmat, cb[i].cmddma);
+ }
+ bus_dmamem_unmap(sc->sc_dmat, xfer_kva, xfersize);
+fail2: bus_dmamem_free(sc->sc_dmat, &seg, 1);
+fail1: free(cb, M_DEVBUF);
+fail0: KASSERT(err);
+ return err;
}
static inline void
Index: src/sys/dev/qbus/if_qe.c
diff -u src/sys/dev/qbus/if_qe.c:1.72 src/sys/dev/qbus/if_qe.c:1.72.4.1
--- src/sys/dev/qbus/if_qe.c:1.72 Fri Oct 25 15:42:50 2013
+++ src/sys/dev/qbus/if_qe.c Fri Aug 22 10:15:22 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: if_qe.c,v 1.72 2013/10/25 15:42:50 martin Exp $ */
+/* $NetBSD: if_qe.c,v 1.72.4.1 2014/08/22 10:15:22 martin Exp $ */
/*
* Copyright (c) 1999 Ludd, University of Lule}, Sweden. All rights reserved.
*
@@ -38,7 +38,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_qe.c,v 1.72 2013/10/25 15:42:50 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_qe.c,v 1.72.4.1 2014/08/22 10:15:22 martin Exp $");
#include "opt_inet.h"
@@ -142,7 +142,7 @@ qematch(device_t parent, cfdata_t cf, vo
#define PROBESIZE 4096
struct qe_ring *ring;
struct qe_ring *rp;
- int error;
+ int error, match;
ring = malloc(PROBESIZE, M_TEMP, M_WAITOK|M_ZERO);
memset(sc, 0, sizeof(*sc));
@@ -161,8 +161,10 @@ qematch(device_t parent, cfdata_t cf, vo
*/
ui.ui_size = PROBESIZE;
ui.ui_vaddr = (void *)&ring[0];
- if ((error = uballoc(uh, &ui, UBA_CANTWAIT)))
- return 0;
+ if ((error = uballoc(uh, &ui, UBA_CANTWAIT))) {
+ match = 0;
+ goto out0;
+ }
/*
* Init a simple "fake" receive and transmit descriptor that
@@ -192,12 +194,14 @@ qematch(device_t parent, cfdata_t cf, vo
QE_WCSR(QE_CSR_XMTH, HIWORD(rp));
DELAY(10000);
+ match = 1;
+
/*
* All done with the bus resources.
*/
ubfree(uh, &ui);
- free(ring, M_TEMP);
- return 1;
+out0: free(ring, M_TEMP);
+ return match;
}
/*
Index: src/sys/dev/rasops/rasops.c
diff -u src/sys/dev/rasops/rasops.c:1.71 src/sys/dev/rasops/rasops.c:1.71.14.1
--- src/sys/dev/rasops/rasops.c:1.71 Thu Apr 19 06:57:39 2012
+++ src/sys/dev/rasops/rasops.c Fri Aug 22 10:15:22 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: rasops.c,v 1.71 2012/04/19 06:57:39 macallan Exp $ */
+/* $NetBSD: rasops.c,v 1.71.14.1 2014/08/22 10:15:22 martin Exp $ */
/*-
* Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rasops.c,v 1.71 2012/04/19 06:57:39 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rasops.c,v 1.71.14.1 2014/08/22 10:15:22 martin Exp $");
#include "opt_rasops.h"
#include "rasops_glue.h"
@@ -1351,16 +1351,21 @@ rasops_rotate_font(int *cookie, int rota
f = malloc(sizeof(struct rotatedfont), M_DEVBUF, M_WAITOK);
if (f == NULL)
- return;
+ goto fail0;
if ((ncookie = wsfont_rotate(*cookie, rotate)) == -1)
- return;
+ goto fail1;
f->rf_cookie = *cookie;
f->rf_rotated = ncookie;
SLIST_INSERT_HEAD(&rotatedfonts, f, rf_next);
*cookie = ncookie;
+ return;
+
+fail1: free(f, M_DEVBUF);
+fail0: /* Just use the existing font, I guess... */
+ return;
}
static void
Index: src/sys/dev/vme/if_ie_vme.c
diff -u src/sys/dev/vme/if_ie_vme.c:1.30 src/sys/dev/vme/if_ie_vme.c:1.30.28.1
--- src/sys/dev/vme/if_ie_vme.c:1.30 Fri Jun 3 16:28:41 2011
+++ src/sys/dev/vme/if_ie_vme.c Fri Aug 22 10:15:22 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: if_ie_vme.c,v 1.30 2011/06/03 16:28:41 tsutsui Exp $ */
+/* $NetBSD: if_ie_vme.c,v 1.30.28.1 2014/08/22 10:15:22 martin Exp $ */
/*
* Copyright (c) 1995 Charles D. Cranor
@@ -140,7 +140,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ie_vme.c,v 1.30 2011/06/03 16:28:41 tsutsui Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ie_vme.c,v 1.30.28.1 2014/08/22 10:15:22 martin Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -424,7 +424,7 @@ ie_vme_match(device_t parent, cfdata_t c
return (0);
}
if (va->r[0].size != VMECF_LEN_DEFAULT &&
- va->r[0].size != sizeof(sizeof(struct ievme))) {
+ va->r[0].size != sizeof(struct ievme)) {
printf("ie_vme_match: bad csr size\n");
return (0);
}
Index: src/sys/net/if_gre.c
diff -u src/sys/net/if_gre.c:1.159 src/sys/net/if_gre.c:1.159.2.1
--- src/sys/net/if_gre.c:1.159 Fri Aug 8 03:05:45 2014
+++ src/sys/net/if_gre.c Fri Aug 22 10:15:22 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: if_gre.c,v 1.159 2014/08/08 03:05:45 rtr Exp $ */
+/* $NetBSD: if_gre.c,v 1.159.2.1 2014/08/22 10:15:22 martin Exp $ */
/*
* Copyright (c) 1998, 2008 The NetBSD Foundation, Inc.
@@ -45,7 +45,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_gre.c,v 1.159 2014/08/08 03:05:45 rtr Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_gre.c,v 1.159.2.1 2014/08/22 10:15:22 martin Exp $");
#include "opt_atalk.h"
#include "opt_gre.h"
@@ -275,7 +275,7 @@ gre_clone_create(struct if_clone *ifc, i
if ((any = sockaddr_any_by_family(AF_INET)) == NULL &&
(any = sockaddr_any_by_family(AF_INET6)) == NULL)
- return -1;
+ goto fail0;
sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
mutex_init(&sc->sc_mtx, MUTEX_DRIVER, IPL_SOFTNET);
@@ -302,9 +302,8 @@ gre_clone_create(struct if_clone *ifc, i
rc = kthread_create(PRI_NONE, KTHREAD_MPSAFE, NULL, gre_fp_recvloop, sc,
NULL, "%s", sc->sc_if.if_xname);
-
- if (rc != 0)
- return -1;
+ if (rc)
+ goto fail1;
gre_evcnt_attach(sc);
@@ -314,6 +313,12 @@ gre_clone_create(struct if_clone *ifc, i
if_alloc_sadl(&sc->sc_if);
bpf_attach(&sc->sc_if, DLT_NULL, sizeof(uint32_t));
return 0;
+
+fail1: cv_destroy(&sc->sc_fp_condvar);
+ cv_destroy(&sc->sc_condvar);
+ mutex_destroy(&sc->sc_mtx);
+ free(sc, M_DEVBUF);
+fail0: return -1;
}
static int
