Module Name: src
Committed By: snj
Date: Sat May 16 04:06:05 UTC 2015
Modified Files:
src/sys/arch/sgimips/dev [netbsd-7]: scn.c
src/sys/arch/sgimips/mace [netbsd-7]: macekbc.c
src/sys/dev/hpc [netbsd-7]: hpcfb.c
src/sys/dev/i2c [netbsd-7]: i2c.c
src/sys/dev/ic [netbsd-7]: mfi.c
src/sys/dev/if_ndis [netbsd-7]: if_ndis_pci.c
src/sys/dev/sysmon [netbsd-7]: sysmon_power.c
src/sys/dev/usb [netbsd-7]: umass_isdata.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #761):
sys/arch/sgimips/dev/scn.c: revision 1.8
sys/arch/sgimips/mace/macekbc.c: revision 1.8
sys/dev/hpc/hpcfb.c: revision 1.59
sys/dev/i2c/i2c.c: revision 1.47
sys/dev/ic/mfi.c: revision 1.57
sys/dev/if_ndis/if_ndis_pci.c: revision 1.21
sys/dev/sysmon/sysmon_power.c: revisions 1.50-1.52
sys/dev/usb/umass_isdata.c: revision 1.31
fix double free, found by Brainy.
--
Free cmd on error if we allocated it.
Found by Brainy, reported by maxv@.
--
don't leak rl (but there are other leaks), found by Brainy.
--
Free ped if we can't hand it to the power daemon.
Found by Brainy, reported by maxv@.
--
don't forget to free the dictionary.
--
another missing free dict.
--
fix leak, found by Brainy.
--
don't malloc a tiny, fixed size buffer to scribble into, then not use it
and never free it either
found by Brainy
--
malloc() -> kmem_alloc() for private data, also kmem_free() them if we
don't finish attaching for whatever reason
found by Brainy
To generate a diff of this commit:
cvs rdiff -u -r1.7 -r1.7.2.1 src/sys/arch/sgimips/dev/scn.c
cvs rdiff -u -r1.7 -r1.7.12.1 src/sys/arch/sgimips/mace/macekbc.c
cvs rdiff -u -r1.58 -r1.58.34.1 src/sys/dev/hpc/hpcfb.c
cvs rdiff -u -r1.44.2.1 -r1.44.2.2 src/sys/dev/i2c/i2c.c
cvs rdiff -u -r1.53.2.1 -r1.53.2.2 src/sys/dev/ic/mfi.c
cvs rdiff -u -r1.19.12.1 -r1.19.12.2 src/sys/dev/if_ndis/if_ndis_pci.c
cvs rdiff -u -r1.47.2.1 -r1.47.2.2 src/sys/dev/sysmon/sysmon_power.c
cvs rdiff -u -r1.29 -r1.29.4.1 src/sys/dev/usb/umass_isdata.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/sgimips/dev/scn.c
diff -u src/sys/arch/sgimips/dev/scn.c:1.7 src/sys/arch/sgimips/dev/scn.c:1.7.2.1
--- src/sys/arch/sgimips/dev/scn.c:1.7 Fri Jul 25 08:10:34 2014
+++ src/sys/arch/sgimips/dev/scn.c Sat May 16 04:06:04 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: scn.c,v 1.7 2014/07/25 08:10:34 dholland Exp $ */
+/* $NetBSD: scn.c,v 1.7.2.1 2015/05/16 04:06:04 snj Exp $ */
/*
* Resurrected from the old pc532 port 1/18/2009.
@@ -92,7 +92,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: scn.c,v 1.7 2014/07/25 08:10:34 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: scn.c,v 1.7.2.1 2015/05/16 04:06:04 snj Exp $");
#include "opt_ddb.h"
#include "opt_kgdb.h"
@@ -815,7 +815,6 @@ scn_attach(device_t parent, device_t sel
u_char mr1, mr2;
enum scntype scntype = SCNUNK;
const char *duart_type = "Unknown";
- char *intrname;
bool console, first;
devmajor_t major;
@@ -906,9 +905,6 @@ scn_attach(device_t parent, device_t sel
ch_base[CH_MR] = mr2;
splx(s);
- intrname = malloc(sizeof("scnXX"), M_DEVBUF, M_NOWAIT);
- snprintf(intrname, sizeof("scnXX"), "scn%d", unit);
-
/*
* On IP6 the console chip is duart1. The keyboard/mouse
* is duart0. Each chip has two channels and the channels
Index: src/sys/arch/sgimips/mace/macekbc.c
diff -u src/sys/arch/sgimips/mace/macekbc.c:1.7 src/sys/arch/sgimips/mace/macekbc.c:1.7.12.1
--- src/sys/arch/sgimips/mace/macekbc.c:1.7 Sat Oct 27 17:18:10 2012
+++ src/sys/arch/sgimips/mace/macekbc.c Sat May 16 04:06:04 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: macekbc.c,v 1.7 2012/10/27 17:18:10 chs Exp $ */
+/* $NetBSD: macekbc.c,v 1.7.12.1 2015/05/16 04:06:04 snj Exp $ */
/*-
* Copyright (c) 2007 Jared D. McNeill <[email protected]>
@@ -31,12 +31,12 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: macekbc.c,v 1.7 2012/10/27 17:18:10 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: macekbc.c,v 1.7.12.1 2015/05/16 04:06:04 snj Exp $");
#include <sys/param.h>
#include <sys/device.h>
#include <sys/syslog.h>
-#include <sys/malloc.h>
+#include <sys/kmem.h>
#include <sys/bus.h>
#include <machine/intr.h>
@@ -125,7 +125,7 @@ macekbc_attach(device_t parent, device_t
aprint_normal(": PS2 controller\n");
aprint_naive("\n");
- t = malloc(sizeof(struct macekbc_internal), M_DEVBUF, M_NOWAIT|M_ZERO);
+ t = kmem_alloc(sizeof(struct macekbc_internal), KM_NOSLEEP);
if (t == NULL) {
aprint_error("%s: not enough memory\n", device_xname(self));
return;
@@ -137,20 +137,20 @@ macekbc_attach(device_t parent, device_t
0, &t->t_ioh[PCKBPORT_KBD_SLOT]) != 0) {
aprint_error("%s: couldn't map kbd registers\n",
device_xname(self));
- return;
+ goto bork;
}
if (bus_space_subregion(t->t_iot, maa->maa_sh, maa->maa_offset + 32,
0, &t->t_ioh[PCKBPORT_AUX_SLOT]) != 0) {
aprint_error("%s: couldn't map aux registers\n",
device_xname(self));
- return;
+ goto bork;
}
if ((t->t_rxih = cpu_intr_establish(maa->maa_intr, maa->maa_intrmask,
macekbc_intr, t)) == NULL) {
printf("%s: couldn't establish interrupt\n",
device_xname(self));
- return;
+ goto bork;
}
sc->sc_id = t;
t->t_sc = sc;
@@ -169,6 +169,9 @@ macekbc_attach(device_t parent, device_t
t->t_present[PCKBPORT_AUX_SLOT] = 1;
return;
+bork:
+ kmem_free(t, sizeof(struct macekbc_internal));
+ return;
}
static int
Index: src/sys/dev/hpc/hpcfb.c
diff -u src/sys/dev/hpc/hpcfb.c:1.58 src/sys/dev/hpc/hpcfb.c:1.58.34.1
--- src/sys/dev/hpc/hpcfb.c:1.58 Sat Nov 13 13:51:59 2010
+++ src/sys/dev/hpc/hpcfb.c Sat May 16 04:06:04 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: hpcfb.c,v 1.58 2010/11/13 13:51:59 uebayasi Exp $ */
+/* $NetBSD: hpcfb.c,v 1.58.34.1 2015/05/16 04:06:04 snj Exp $ */
/*-
* Copyright (c) 1999
@@ -43,7 +43,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: hpcfb.c,v 1.58 2010/11/13 13:51:59 uebayasi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: hpcfb.c,v 1.58.34.1 2015/05/16 04:06:04 snj Exp $");
#ifdef _KERNEL_OPT
#include "opt_hpcfb.h"
@@ -472,7 +472,8 @@ hpcfb_init(struct hpcfb_fbconf *fbconf,
}
if (rasops_init(ri, HPCFB_MAX_ROW, HPCFB_MAX_COLUMN)) {
- panic("%s(%d): rasops_init() failed!", __FILE__, __LINE__);
+ aprint_error_dev(dc->dc_sc->sc_dev, "rasops_init() failed!")
+ return -1;
}
/* over write color map of rasops */
@@ -722,13 +723,15 @@ hpcfb_alloc_screen(void *v, const struct
DPRINTF(("%s(%d): hpcfb_alloc_screen()\n", __FILE__, __LINE__));
- dc = malloc(sizeof(struct hpcfb_devconfig), M_DEVBUF, M_WAITOK|M_ZERO);
+ dc = malloc(sizeof(*dc), M_DEVBUF, M_WAITOK|M_ZERO);
if (dc == NULL)
- return (ENOMEM);
+ return ENOMEM;
dc->dc_sc = sc;
- if (hpcfb_init(&sc->sc_fbconflist[0], dc) != 0)
- return (EINVAL);
+ if (hpcfb_init(&sc->sc_fbconflist[0], dc) != 0) {
+ free(dc, M_DEVBUF);
+ return EINVAL;
+ }
if (sc->sc_accessops->font) {
sc->sc_accessops->font(sc->sc_accessctx,
dc->dc_rinfo.ri_font);
Index: src/sys/dev/i2c/i2c.c
diff -u src/sys/dev/i2c/i2c.c:1.44.2.1 src/sys/dev/i2c/i2c.c:1.44.2.2
--- src/sys/dev/i2c/i2c.c:1.44.2.1 Fri Jan 23 09:50:36 2015
+++ src/sys/dev/i2c/i2c.c Sat May 16 04:06:04 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: i2c.c,v 1.44.2.1 2015/01/23 09:50:36 martin Exp $ */
+/* $NetBSD: i2c.c,v 1.44.2.2 2015/05/16 04:06:04 snj Exp $ */
/*
* Copyright (c) 2003 Wasabi Systems, Inc.
@@ -36,7 +36,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i2c.c,v 1.44.2.1 2015/01/23 09:50:36 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i2c.c,v 1.44.2.2 2015/05/16 04:06:04 snj Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -522,6 +522,8 @@ iic_ioctl_exec(struct iic_softc *sc, i2c
if (iie->iie_buf != NULL && I2C_OP_WRITE_P(iie->iie_op)) {
error = copyin(iie->iie_buf, buf, iie->iie_buflen);
if (error) {
+ if (cmd)
+ kmem_free(cmd, iie->iie_cmdlen);
return error;
}
}
Index: src/sys/dev/ic/mfi.c
diff -u src/sys/dev/ic/mfi.c:1.53.2.1 src/sys/dev/ic/mfi.c:1.53.2.2
--- src/sys/dev/ic/mfi.c:1.53.2.1 Fri Aug 22 10:41:18 2014
+++ src/sys/dev/ic/mfi.c Sat May 16 04:06:04 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: mfi.c,v 1.53.2.1 2014/08/22 10:41:18 martin Exp $ */
+/* $NetBSD: mfi.c,v 1.53.2.2 2015/05/16 04:06:04 snj Exp $ */
/* $OpenBSD: mfi.c,v 1.66 2006/11/28 23:59:45 dlg Exp $ */
/*
@@ -73,7 +73,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mfi.c,v 1.53.2.1 2014/08/22 10:41:18 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mfi.c,v 1.53.2.2 2015/05/16 04:06:04 snj Exp $");
#include "bio.h"
@@ -3426,8 +3426,7 @@ again:
ld_size = sizeof(*ld_sync) * sc->sc_ld_list.mll_no_ld;
- ld_sync = (struct mfi_ld *) malloc(ld_size, M_DEVBUF,
- M_WAITOK | M_ZERO);
+ ld_sync = malloc(ld_size, M_DEVBUF, M_WAITOK | M_ZERO);
if (ld_sync == NULL) {
aprint_error_dev(sc->sc_dev, "Failed to allocate sync\n");
goto err;
@@ -3438,7 +3437,6 @@ again:
if ((ccb = mfi_get_ccb(sc)) == NULL) {
aprint_error_dev(sc->sc_dev, "Failed to get sync command\n");
- free(ld_sync, M_DEVBUF);
goto err;
}
sc->sc_ldsync_ccb = ccb;
Index: src/sys/dev/if_ndis/if_ndis_pci.c
diff -u src/sys/dev/if_ndis/if_ndis_pci.c:1.19.12.1 src/sys/dev/if_ndis/if_ndis_pci.c:1.19.12.2
--- src/sys/dev/if_ndis/if_ndis_pci.c:1.19.12.1 Mon Oct 20 09:55:54 2014
+++ src/sys/dev/if_ndis/if_ndis_pci.c Sat May 16 04:06:04 2015
@@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ndis_pci.c,v 1.19.12.1 2014/10/20 09:55:54 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ndis_pci.c,v 1.19.12.2 2015/05/16 04:06:04 snj Exp $");
#ifdef __FreeBSD__
__FBSDID("$FreeBSD: src/sys/dev/if_ndis/if_ndis_pci.c,v 1.8.2.3 2005/03/31 04:24:36 wpaul Exp $");
#endif
@@ -204,6 +204,7 @@ void ndis_attach_pci(device_t parent, de
int revision, i;
#endif
int bar;
+ size_t rllen;
printf("in ndis_attach_pci()\n");
@@ -227,9 +228,9 @@ void ndis_attach_pci(device_t parent, de
printf("sc->ndis_mtag = %x\n", (unsigned int)sc->ndis_mtag);
- rl = malloc(sizeof(ndis_resource_list) +
- (sizeof(cm_partial_resource_desc) * (MAX_RESOURCES-1)),
- M_DEVBUF, M_NOWAIT|M_ZERO);
+ rllen = sizeof(ndis_resource_list) +
+ sizeof(cm_partial_resource_desc) * (MAX_RESOURCES - 1);
+ rl = malloc(rllen, M_DEVBUF, M_NOWAIT|M_ZERO);
if(rl == NULL) {
sc->error = ENOMEM;
@@ -272,7 +273,7 @@ void ndis_attach_pci(device_t parent, de
malloc(sizeof(struct ndis_resource), M_DEVBUF, M_NOWAIT | M_ZERO)) == NULL) {
//printf("error: out of memory\n");
sc->error = ENOMEM;
- return;
+ goto out;
}
sc->ndis_res_io->res_base = base;
sc->ndis_res_io->res_size = size;
@@ -293,7 +294,7 @@ void ndis_attach_pci(device_t parent, de
sc->ndis_res_altmem != NULL) {
printf("too many resources\n");
sc->error = ENXIO;
- return;
+ goto out;
}
if(sc->ndis_res_mem) {
if((sc->ndis_res_altmem =
@@ -317,7 +318,7 @@ void ndis_attach_pci(device_t parent, de
if((sc->ndis_res_mem =
malloc(sizeof(struct ndis_resource), M_DEVBUF, M_NOWAIT | M_ZERO)) == NULL) {
sc->error = ENOMEM;
- return;
+ goto out;
}
sc->ndis_res_mem->res_base = base;
sc->ndis_res_mem->res_size = size;
@@ -364,6 +365,10 @@ void ndis_attach_pci(device_t parent, de
kthread_create(PRI_NONE, 0, NULL, ndis_attach, (void *)sc,
NULL, "ndis_attach");
+ return;
+out:
+ free(rl, M_DEVBUF);
+ return;
}
Index: src/sys/dev/sysmon/sysmon_power.c
diff -u src/sys/dev/sysmon/sysmon_power.c:1.47.2.1 src/sys/dev/sysmon/sysmon_power.c:1.47.2.2
--- src/sys/dev/sysmon/sysmon_power.c:1.47.2.1 Mon Jan 12 21:15:12 2015
+++ src/sys/dev/sysmon/sysmon_power.c Sat May 16 04:06:05 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: sysmon_power.c,v 1.47.2.1 2015/01/12 21:15:12 snj Exp $ */
+/* $NetBSD: sysmon_power.c,v 1.47.2.2 2015/05/16 04:06:05 snj Exp $ */
/*-
* Copyright (c) 2007 Juan Romero Pardines.
@@ -69,7 +69,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sysmon_power.c,v 1.47.2.1 2015/01/12 21:15:12 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sysmon_power.c,v 1.47.2.2 2015/05/16 04:06:05 snj Exp $");
#include "opt_compat_netbsd.h"
#include <sys/param.h>
@@ -800,6 +800,9 @@ sysmon_penvsys_event(struct penvsys_stat
if (sysmon_power_daemon_task(ped, pes, event) == 0)
return;
+ /* We failed */
+ prop_object_release(ped->dict);
+ kmem_free(ped, sizeof(*ped));
}
switch (pes->pes_type) {
@@ -954,6 +957,9 @@ sysmon_pswitch_event(struct sysmon_pswit
if (sysmon_power_daemon_task(ped, smpsw, event) == 0)
return;
+ /* We failed */
+ prop_object_release(ped->dict);
+ kmem_free(ped, sizeof(*ped));
}
switch (smpsw->smpsw_type) {
Index: src/sys/dev/usb/umass_isdata.c
diff -u src/sys/dev/usb/umass_isdata.c:1.29 src/sys/dev/usb/umass_isdata.c:1.29.4.1
--- src/sys/dev/usb/umass_isdata.c:1.29 Wed Oct 30 15:37:49 2013
+++ src/sys/dev/usb/umass_isdata.c Sat May 16 04:06:05 2015
@@ -1,4 +1,4 @@
-/* $NetBSD: umass_isdata.c,v 1.29 2013/10/30 15:37:49 drochner Exp $ */
+/* $NetBSD: umass_isdata.c,v 1.29.4.1 2015/05/16 04:06:05 snj Exp $ */
/*
* TODO:
@@ -37,7 +37,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: umass_isdata.c,v 1.29 2013/10/30 15:37:49 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: umass_isdata.c,v 1.29.4.1 2015/05/16 04:06:05 snj Exp $");
#ifdef _KERNEL_OPT
#include "opt_umass.h"
@@ -199,8 +199,11 @@ umass_isdata_attach(struct umass_softc *
USETW(req.wLength, sizeof *cf);
err = usbd_do_request(sc->sc_udev, &req, cf);
- if (err)
- return (EIO);
+ if (err) {
+ sc->bus = NULL;
+ free(scbus, M_DEVBUF);
+ return EIO;
+ }
DPRINTF(("umass_wd_attach info:\n EventNotification=0x%02x "
"ExternalClock=0x%02x ATAInitTimeout=0x%02x\n"
" ATAMisc1=0x%02x ATAMajorCommand=0x%02x "
