The driver already keeps track of the number of ports, so use this piece of information to free allocated structures.
Ok? Index: uhub.c =================================================================== RCS file: /cvs/src/sys/dev/usb/uhub.c,v retrieving revision 1.90 diff -u -p -r1.90 uhub.c --- uhub.c 8 Apr 2017 02:57:25 -0000 1.90 +++ uhub.c 8 Nov 2018 16:45:44 -0000 @@ -292,7 +292,7 @@ uhub_attach(struct device *parent, struc if (UHUB_IS_HIGH_SPEED(sc)) { tts = mallocarray((UHUB_IS_SINGLE_TT(sc) ? 1 : nports), - sizeof (struct usbd_tt), M_USBDEV, M_NOWAIT); + sizeof(struct usbd_tt), M_USBDEV, M_NOWAIT); if (!tts) goto bad; } @@ -339,12 +339,10 @@ uhub_attach(struct device *parent, struc return; bad: - if (sc->sc_statusbuf) - free(sc->sc_statusbuf, M_USBDEV, sc->sc_statuslen); + free(sc->sc_statusbuf, M_USBDEV, sc->sc_statuslen); if (hub) { - if (hub->ports) - free(hub->ports, M_USBDEV, 0); - free(hub, M_USBDEV, sizeof *hub); + free(hub->ports, M_USBDEV, hub->nports * sizeof(*hub->ports)); + free(hub, M_USBDEV, sizeof(*hub)); } dev->hub = NULL; } @@ -474,13 +472,11 @@ uhub_detach(struct device *self, int fla } } - if (hub->ports[0].tt) - free(hub->ports[0].tt, M_USBDEV, 0); - if (sc->sc_statusbuf) - free(sc->sc_statusbuf, M_USBDEV, sc->sc_statuslen); - if (hub->ports) - free(hub->ports, M_USBDEV, 0); - free(hub, M_USBDEV, sizeof *hub); + free(hub->ports[0].tt, M_USBDEV, + (UHUB_IS_SINGLE_TT(sc) ? 1 : hub->nports) * sizeof(struct usbd_tt)); + free(sc->sc_statusbuf, M_USBDEV, sc->sc_statuslen); + free(hub->ports, M_USBDEV, hub->nports * sizeof(*hub->ports)); + free(hub, M_USBDEV, sizeof(*hub)); sc->sc_hub->hub = NULL; return (0);