sizes for free(); ok sthen

5 files changed, 44 insertions, 41 deletions

diff --git a/sys/dev/ic/ami.c b/sys/dev/ic/ami.c
index 1b654df2cce..d9ae5176a42 100644
--- a/sys/dev/ic/ami.c
+++ b/sys/dev/ic/ami.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ami.c,v 1.230 2014/11/05 01:02:10 daniel Exp $	*/
+/*	$OpenBSD: ami.c,v 1.231 2015/09/09 18:23:55 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2001 Michael Shalayeff
@@ -261,7 +261,7 @@ free:
 destroy:
 	bus_dmamap_destroy(sc->sc_dmat, am->am_map);
 amfree:
-	free(am, M_DEVBUF, 0);
+	free(am, M_DEVBUF, sizeof *am);
 
 	return (NULL);
 }
@@ -273,7 +273,7 @@ ami_freemem(struct ami_softc *sc, struct ami_mem *am)
 	bus_dmamem_unmap(sc->sc_dmat, am->am_kva, am->am_size);
 	bus_dmamem_free(sc->sc_dmat, &am->am_seg, 1);
 	bus_dmamap_destroy(sc->sc_dmat, am->am_map);
-	free(am, M_DEVBUF, 0);
+	free(am, M_DEVBUF, sizeof *am);
 }
 
 void
@@ -1948,7 +1948,7 @@ ami_ioctl_inq(struct ami_softc *sc, struct bioc_inq *bi)
 	bcopy(bi, &sc->sc_bi, sizeof sc->sc_bi);
 	error = 0;
 bail:
-	free(p, M_DEVBUF, 0);
+	free(p, M_DEVBUF, sizeof *p);
 done:
 	dma_free(inqbuf, sizeof(*inqbuf));
 	return (error);
@@ -2181,7 +2181,7 @@ ami_ioctl_vol(struct ami_softc *sc, struct bioc_vol *bv)
 	strlcpy(bv->bv_dev, sc->sc_hdr[i].dev, sizeof(bv->bv_dev));
 	
 bail:
-	free(p, M_DEVBUF, 0);
+	free(p, M_DEVBUF, sizeof *p);
 
 	return (error);
 }
@@ -2444,9 +2444,9 @@ ami_create_sensors(struct ami_softc *sc)
 	return (0);
 
 freebd:
-	free(sc->sc_bd, M_DEVBUF, 0);
+	free(sc->sc_bd, M_DEVBUF, sizeof(*sc->sc_bd));
 bad:
-	free(sc->sc_sensors, M_DEVBUF, 0);
+	free(sc->sc_sensors, M_DEVBUF, sc->sc_nunits * sizeof(struct ksensor));
 
 	return (1);
 }
diff --git a/sys/dev/ic/ciss.c b/sys/dev/ic/ciss.c
index fc3bf1f896b..324efc09397 100644
--- a/sys/dev/ic/ciss.c
+++ b/sys/dev/ic/ciss.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ciss.c,v 1.73 2015/05/03 02:10:13 jsg Exp $	*/
+/*	$OpenBSD: ciss.c,v 1.74 2015/09/09 18:23:55 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2005,2006 Michael Shalayeff
@@ -401,7 +401,8 @@ ciss_attach(struct ciss_softc *sc)
 			sensor_attach(&sc->sensordev, &sc->sensors[i]);
 		}
 		if (sensor_task_register(sc, ciss_sensors, 10) == NULL)
-			free(sc->sensors, M_DEVBUF, 0);
+			free(sc->sensors, M_DEVBUF,
+			    sc->maxunits * sizeof(struct ksensor));
 		else
 			sensordev_install(&sc->sensordev);
 	}
diff --git a/sys/dev/ic/malo.c b/sys/dev/ic/malo.c
index 9b325227946..2845fb335a3 100644
--- a/sys/dev/ic/malo.c
+++ b/sys/dev/ic/malo.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: malo.c,v 1.106 2015/07/06 07:20:03 stsp Exp $ */
+/*	$OpenBSD: malo.c,v 1.107 2015/09/09 18:23:55 deraadt Exp $ */
 
 /*
  * Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
@@ -1798,10 +1798,10 @@ malo_load_bootimg(struct malo_softc *sc)
 	if (i == 10) {
 		printf("%s: timeout at boot firmware load!\n",
 		    sc->sc_dev.dv_xname);
-		free(ucode, M_DEVBUF, 0);
+		free(ucode, M_DEVBUF, size);
 		return (ETIMEDOUT);
 	}
-	free(ucode, M_DEVBUF, 0);
+	free(ucode, M_DEVBUF, size);
 
 	/* tell the card we're done and... */
 	malo_mem_write2(sc, 0xbef8, 0x001);
diff --git a/sys/dev/ic/mfi.c b/sys/dev/ic/mfi.c
index 3da6e73f71b..5386f7e8220 100644
--- a/sys/dev/ic/mfi.c
+++ b/sys/dev/ic/mfi.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mfi.c,v 1.164 2015/05/29 00:33:37 uebayasi Exp $ */
+/* $OpenBSD: mfi.c,v 1.165 2015/09/09 18:23:55 deraadt Exp $ */
 /*
  * Copyright (c) 2006 Marco Peereboom <marco@peereboom.us>
  *
@@ -377,7 +377,7 @@ free:
 destroy:
 	bus_dmamap_destroy(sc->sc_dmat, mm->am_map);
 amfree:
-	free(mm, M_DEVBUF, 0);
+	free(mm, M_DEVBUF, sizeof *mm);
 
 	return (NULL);
 }
@@ -391,7 +391,7 @@ mfi_freemem(struct mfi_softc *sc, struct mfi_mem *mm)
 	bus_dmamem_unmap(sc->sc_dmat, mm->am_kva, mm->am_size);
 	bus_dmamem_free(sc->sc_dmat, &mm->am_seg, 1);
 	bus_dmamap_destroy(sc->sc_dmat, mm->am_map);
-	free(mm, M_DEVBUF, 0);
+	free(mm, M_DEVBUF, sizeof *mm);
 }
 
 int
@@ -862,7 +862,7 @@ mfi_syspd(struct mfi_softc *sc)
 		sc->sc_pd->pd_links[i] = pl;
 	}
 
-	free(pd, M_TEMP, 0);
+	free(pd, M_TEMP, sizeof *pd);
 
 	link = &sc->sc_pd->pd_link;
 	link->adapter = &mfi_pd_switch;
@@ -885,12 +885,12 @@ nopl:
 		if (pl == NULL)
 			break;
 
-		free(pl, M_DEVBUF, 0);
+		free(pl, M_DEVBUF, sizeof *pl);
 	}
 nopd:
-	free(pd, M_TEMP, 0);
+	free(pd, M_TEMP, sizeof *pd);
 nopdsc:
-	free(sc->sc_pd, M_DEVBUF, 0);
+	free(sc->sc_pd, M_DEVBUF, sizeof *sc->sc_pd);
 	return (1);
 }
 
@@ -1599,19 +1599,19 @@ mfi_bio_getitall(struct mfi_softc *sc)
 		goto done;
 	if (mfi_mgmt(sc, MR_DCMD_CONF_GET, MFI_DATA_IN, sizeof *cfg, cfg,
 	    NULL)) {
-		free(cfg, M_DEVBUF, 0);
+		free(cfg, M_DEVBUF, sizeof *cfg);
 		goto done;
 	}
 
 	size = cfg->mfc_size;
-	free(cfg, M_DEVBUF, 0);
+	free(cfg, M_DEVBUF, sizeof *cfg);
 
 	/* memory for read config */
 	cfg = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (cfg == NULL)
 		goto done;
 	if (mfi_mgmt(sc, MR_DCMD_CONF_GET, MFI_DATA_IN, size, cfg, NULL)) {
-		free(cfg, M_DEVBUF, 0);
+		free(cfg, M_DEVBUF, size);
 		goto done;
 	}
 
@@ -1631,7 +1631,7 @@ mfi_bio_getitall(struct mfi_softc *sc)
 		if (sc->sc_ld_details)
 			free(sc->sc_ld_details, M_DEVBUF, 0);
 
-		ld_det = malloc( size, M_DEVBUF, M_NOWAIT | M_ZERO);
+		ld_det = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
 		if (ld_det == NULL)
 			goto done;
 		sc->sc_ld_sz = size;
@@ -1894,7 +1894,7 @@ mfi_ioctl_disk(struct mfi_softc *sc, struct bioc_disk *bd)
 
 	rv = 0;
 freeme:
-	free(pd, M_DEVBUF, 0);
+	free(pd, M_DEVBUF, sizeof *pd);
 
 	return (rv);
 }
@@ -2002,7 +2002,7 @@ mfi_ioctl_blink(struct mfi_softc *sc, struct bioc_blink *bb)
 
 	rv = 0;
 done:
-	free(pd, M_DEVBUF, 0);
+	free(pd, M_DEVBUF, sizeof *pd);
 	return (rv);
 }
 
@@ -2074,8 +2074,8 @@ mfi_ioctl_setstate(struct mfi_softc *sc, struct bioc_setstate *bs)
 
 	rv = 0;
 done:
-	free(pd, M_DEVBUF, 0);
-	free(info, M_DEVBUF, 0);
+	free(pd, M_DEVBUF, sizeof *pd);
+	free(info, M_DEVBUF, sizeof *info);
 	return (rv);
 }
 
@@ -2242,7 +2242,7 @@ mfi_bio_hs(struct mfi_softc *sc, int volid, int type, void *bio_hs)
 		goto freeme;
 
 	size = cfg->mfc_size;
-	free(cfg, M_DEVBUF, 0);
+	free(cfg, M_DEVBUF, sizeof *cfg);
 
 	/* memory for read config */
 	cfg = malloc(size, M_DEVBUF, M_WAITOK|M_ZERO);
@@ -2307,7 +2307,7 @@ mfi_bio_hs(struct mfi_softc *sc, int volid, int type, void *bio_hs)
 	DNPRINTF(MFI_D_IOCTL, "%s: mfi_vol_hs 6\n", DEVNAME(sc));
 	rv = 0;
 freeme:
-	free(pd, M_DEVBUF, 0);
+	free(pd, M_DEVBUF, sizeof *pd);
 	free(cfg, M_DEVBUF, 0);
 
 	return (rv);
@@ -2475,7 +2475,8 @@ mfi_create_sensors(struct mfi_softc *sc)
 	return (0);
 
 bad:
-	free(sc->sc_sensors, M_DEVBUF, 0);
+	free(sc->sc_sensors, M_DEVBUF,
+	    sc->sc_ld_cnt * sizeof(struct ksensor));
 
 	return (1);
 }
diff --git a/sys/dev/ic/mpi.c b/sys/dev/ic/mpi.c
index 9796229e459..44187857201 100644
--- a/sys/dev/ic/mpi.c
+++ b/sys/dev/ic/mpi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mpi.c,v 1.201 2015/05/04 03:59:42 jsg Exp $ */
+/*	$OpenBSD: mpi.c,v 1.202 2015/09/09 18:23:55 deraadt Exp $ */
 
 /*
  * Copyright (c) 2005, 2006, 2009 David Gwynne <dlg@openbsd.org>
@@ -561,7 +561,7 @@ mpi_run_ppr(struct mpi_softc *sc)
 	}
 
 out:
-	free(physdisk_pg, M_TEMP, 0);
+	free(physdisk_pg, M_TEMP, pagelen);
 }
 
 int
@@ -857,7 +857,7 @@ mpi_cfg_sas(struct mpi_softc *sc)
 	}
 
 out:
-	free(pg, M_TEMP, 0);
+	free(pg, M_TEMP, pagelen);
 	return (rv);
 }
 
@@ -1021,7 +1021,7 @@ free:
 destroy:
 	bus_dmamap_destroy(sc->sc_dmat, mdm->mdm_map);
 mdmfree:
-	free(mdm, M_DEVBUF, 0);
+	free(mdm, M_DEVBUF, sizeof *mdm);
 
 	return (NULL);
 }
@@ -1035,7 +1035,7 @@ mpi_dmamem_free(struct mpi_softc *sc, struct mpi_dmamem *mdm)
 	bus_dmamem_unmap(sc->sc_dmat, mdm->mdm_kva, mdm->mdm_size);
 	bus_dmamem_free(sc->sc_dmat, &mdm->mdm_seg, 1);
 	bus_dmamap_destroy(sc->sc_dmat, mdm->mdm_map);
-	free(mdm, M_DEVBUF, 0);
+	free(mdm, M_DEVBUF, sizeof *mdm);
 }
 
 int
@@ -1641,7 +1641,7 @@ mpi_scsi_probe_virtual(struct scsi_link *link)
 	if (rv == 0)
 		SET(link->flags, SDEV_VIRTUAL);
 
-	free(rp0, M_TEMP, 0);
+	free(rp0, M_TEMP, len);
 	return (0);
 }
 
@@ -2710,7 +2710,7 @@ mpi_manufacturing(struct mpi_softc *sc)
 	rv = 0;
 
 out:
-	free(pg, M_TEMP, 0);
+	free(pg, M_TEMP, pagelen);
 	return (rv);
 }
 
@@ -2763,7 +2763,7 @@ mpi_get_raid(struct mpi_softc *sc)
 		sc->sc_flags |= MPI_F_RAID;
 
 out:
-	free(vol_page, M_TEMP, 0);
+	free(vol_page, M_TEMP, pagelen);
 }
 
 int
@@ -3086,7 +3086,7 @@ mpi_ioctl_cache(struct scsi_link *link, u_long cmd, struct dk_cache *dc)
 	scsi_io_put(&sc->sc_iopool, ccb);
 
 done:
-	free(rpg0, M_TEMP, 0);
+	free(rpg0, M_TEMP, len);
 	return (rv);
 }
 
@@ -3402,7 +3402,7 @@ mpi_create_sensors(struct mpi_softc *sc)
 {
 	struct device		*dev;
 	struct scsi_link	*link;
-	int			i, vol;
+	int			i, vol, nsensors;
 
 	/* count volumes */
 	for (i = 0, vol = 0; i < sc->sc_buswidth; i++) {
@@ -3422,6 +3422,7 @@ mpi_create_sensors(struct mpi_softc *sc)
 	    M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (sc->sc_sensors == NULL)
 		return (1);
+	nsensors = vol;
 
 	strlcpy(sc->sc_sensordev.xname, DEVNAME(sc),
 	    sizeof(sc->sc_sensordev.xname));
@@ -3452,7 +3453,7 @@ mpi_create_sensors(struct mpi_softc *sc)
 	return (0);
 
 bad:
-	free(sc->sc_sensors, M_DEVBUF, 0);
+	free(sc->sc_sensors, M_DEVBUF, nsensors * sizeof(struct ksensor));
 	return (1);
 }