kern files, easy fixes. Index: kern_sensors.c =================================================================== RCS file: /cvs/src/sys/kern/kern_sensors.c,v retrieving revision 1.29 diff -u -p -r1.29 kern_sensors.c --- kern_sensors.c 14 Sep 2014 14:17:25 -0000 1.29 +++ kern_sensors.c 30 Oct 2014 17:33:29 -0000 @@ -247,7 +247,7 @@ sensor_task_work(void *xst, void *arg) rw_exit_write(&st->lock); if (period == 0) - free(st, M_DEVBUF, 0); + free(st, M_DEVBUF, sizeof(struct sensor_task)); else timeout_add_sec(&st->timeout, period); } Index: kern_subr.c =================================================================== RCS file: /cvs/src/sys/kern/kern_subr.c,v retrieving revision 1.40 diff -u -p -r1.40 kern_subr.c --- kern_subr.c 13 Jul 2014 15:48:41 -0000 1.40 +++ kern_subr.c 30 Oct 2014 17:32:56 -0000 @@ -221,7 +221,7 @@ hook_disestablish(struct hook_desc_head #endif hdp = vhook; TAILQ_REMOVE(head, hdp, hd_list); - free(hdp, M_DEVBUF, 0); + free(hdp, M_DEVBUF, sizeof(*hdp)); } /* @@ -244,7 +244,7 @@ dohooks(struct hook_desc_head *head, int TAILQ_REMOVE(head, hdp, hd_list); (*hdp->hd_fn)(hdp->hd_arg); if ((flags & HOOK_FREE) != 0) - free(hdp, M_DEVBUF, 0); + free(hdp, M_DEVBUF, sizeof(*hdp)); } } } Index: kern_sysctl.c =================================================================== RCS file: /cvs/src/sys/kern/kern_sysctl.c,v retrieving revision 1.267 diff -u -p -r1.267 kern_sysctl.c --- kern_sysctl.c 17 Oct 2014 01:51:39 -0000 1.267 +++ kern_sysctl.c 30 Oct 2014 17:30:59 -0000 @@ -1288,7 +1288,7 @@ sysctl_file(int *name, u_int namelen, ch error = EINVAL; break; } - free(kf, M_TEMP, 0); + free(kf, M_TEMP, sizeof(*kf)); if (!error) { if (where == NULL) @@ -1451,7 +1451,7 @@ again: } err: if (kproc) - free(kproc, M_TEMP, 0); + free(kproc, M_TEMP, sizeof(*kproc)); return (error); } @@ -1732,7 +1732,7 @@ more: out: uvmspace_free(vm); - free(buf, M_TEMP, 0); + free(buf, M_TEMP, PAGE_SIZE); return (error); } @@ -1796,7 +1796,7 @@ sysctl_proc_cwd(int *name, u_int namelen } vrele(vp); - free(path, M_TEMP, 0); + free(path, M_TEMP, len); return (error); } @@ -2095,7 +2095,7 @@ sysctl_sensors(int *name, u_int namelen, ret = sysctl_rdstruct(oldp, oldlenp, newp, usd, sizeof(struct sensordev)); - free(usd, M_TEMP, 0); + free(usd, M_TEMP, sizeof(*usd)); return (ret); } @@ -2118,7 +2118,7 @@ sysctl_sensors(int *name, u_int namelen, ret = sysctl_rdstruct(oldp, oldlenp, newp, us, sizeof(struct sensor)); - free(us, M_TEMP, 0); + free(us, M_TEMP, sizeof(*us)); return (ret); } Index: kern_task.c =================================================================== RCS file: /cvs/src/sys/kern/kern_task.c,v retrieving revision 1.11 diff -u -p -r1.11 kern_task.c --- kern_task.c 8 Oct 2014 15:28:39 -0000 1.11 +++ kern_task.c 30 Oct 2014 17:31:46 -0000 @@ -129,7 +129,7 @@ taskq_destroy(struct taskq *tq) } mtx_leave(&tq->tq_mtx); - free(tq, M_DEVBUF, 0); + free(tq, M_DEVBUF, sizeof(*tq)); } void @@ -143,7 +143,7 @@ taskq_create_thread(void *arg) switch (tq->tq_state) { case TQ_S_DESTROYED: mtx_leave(&tq->tq_mtx); - free(tq, M_DEVBUF, 0); + free(tq, M_DEVBUF, sizeof(*tq)); return; case TQ_S_CREATED: Index: kern_tc.c =================================================================== RCS file: /cvs/src/sys/kern/kern_tc.c,v retrieving revision 1.26 diff -u -p -r1.26 kern_tc.c --- kern_tc.c 14 Sep 2014 14:17:25 -0000 1.26 +++ kern_tc.c 30 Oct 2014 17:32:19 -0000 @@ -541,7 +541,7 @@ sysctl_tc_choice(void *oldp, size_t *old strlcat(choices, buf, maxlen); } error = sysctl_rdstring(oldp, oldlenp, newp, choices); - free(choices, M_TEMP, 0); + free(choices, M_TEMP, maxlen); return (error); } Index: kern_workq.c =================================================================== RCS file: /cvs/src/sys/kern/kern_workq.c,v retrieving revision 1.16 diff -u -p -r1.16 kern_workq.c --- kern_workq.c 8 Oct 2014 15:28:39 -0000 1.16 +++ kern_workq.c 30 Oct 2014 17:31:29 -0000 @@ -116,7 +116,7 @@ workq_destroy(struct workq *wq) } mtx_leave(&wq->wq_mtx); - free(wq, M_DEVBUF, 0); + free(wq, M_DEVBUF, sizeof(*wq)); } int @@ -164,7 +164,7 @@ workq_create_thread(void *arg) switch (wq->wq_state) { case WQ_S_DESTROYED: mtx_leave(&wq->wq_mtx); - free(wq, M_DEVBUF, 0); + free(wq, M_DEVBUF, sizeof(*wq)); return; case WQ_S_CREATED: