free(9) sizes for endpoints array.

ok okan@, tedu@, visa@

3 files changed, 13 insertions, 9 deletions

diff --git a/sys/dev/usb/usb_subr.c b/sys/dev/usb/usb_subr.c
index aef7519a61e..1216921a703 100644
--- a/sys/dev/usb/usb_subr.c
+++ b/sys/dev/usb/usb_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usb_subr.c,v 1.138 2018/07/19 12:35:14 mpi Exp $ */
+/*	$OpenBSD: usb_subr.c,v 1.139 2018/11/10 15:34:25 mpi Exp $ */
 /*	$NetBSD: usb_subr.c,v 1.103 2003/01/10 11:19:13 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $	*/
 
@@ -515,6 +515,7 @@ usbd_fill_iface_data(struct usbd_device *dev, int ifaceidx, int altidx)
 	ifc->endpoints = NULL;
 	ifc->priv = NULL;
 	LIST_INIT(&ifc->pipes);
+	ifc->nendpt = nendpt;
 
 	if (nendpt != 0) {
 		ifc->endpoints = mallocarray(nendpt, sizeof(*ifc->endpoints),
@@ -592,8 +593,9 @@ void
 usbd_free_iface_data(struct usbd_device *dev, int ifcno)
 {
 	struct usbd_interface *ifc = &dev->ifaces[ifcno];
-	if (ifc->endpoints)
-		free(ifc->endpoints, M_USB, 0);
+
+	free(ifc->endpoints, M_USB, ifc->nendpt * sizeof(*ifc->endpoints));
+	ifc->endpoints = NULL;
 }
 
 usbd_status
diff --git a/sys/dev/usb/usbdi.c b/sys/dev/usb/usbdi.c
index fa309cd44e9..befa6c80ed7 100644
--- a/sys/dev/usb/usbdi.c
+++ b/sys/dev/usb/usbdi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usbdi.c,v 1.98 2018/04/29 08:57:48 mpi Exp $ */
+/*	$OpenBSD: usbdi.c,v 1.99 2018/11/10 15:34:25 mpi Exp $ */
 /*	$NetBSD: usbdi.c,v 1.103 2002/09/27 15:37:38 provos Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usbdi.c,v 1.28 1999/11/17 22:33:49 n_hibma Exp $	*/
 
@@ -657,19 +657,20 @@ usbd_set_interface(struct usbd_interface *iface, int altidx)
 {
 	usb_device_request_t req;
 	usbd_status err;
-	void *endpoints;
+	struct usbd_endpoint *endpoints;
+	int nendpt;
 
 	if (LIST_FIRST(&iface->pipes) != 0)
 		return (USBD_IN_USE);
 
 	endpoints = iface->endpoints;
+	nendpt = iface->nendpt;
 	err = usbd_fill_iface_data(iface->device, iface->index, altidx);
 	if (err)
 		return (err);
 
 	/* new setting works, we can free old endpoints */
-	if (endpoints != NULL)
-		free(endpoints, M_USB, 0);
+	free(endpoints, M_USB, nendpt * sizeof(*endpoints));
 
 #ifdef DIAGNOSTIC
 	if (iface->idesc == NULL) {
diff --git a/sys/dev/usb/usbdivar.h b/sys/dev/usb/usbdivar.h
index 53c32f0153d..7abab89d5ce 100644
--- a/sys/dev/usb/usbdivar.h
+++ b/sys/dev/usb/usbdivar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usbdivar.h,v 1.75 2018/05/01 18:14:46 landry Exp $ */
+/*	$OpenBSD: usbdivar.h,v 1.76 2018/11/10 15:34:25 mpi Exp $ */
 /*	$NetBSD: usbdivar.h,v 1.70 2002/07/11 21:14:36 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usbdivar.h,v 1.11 1999/11/17 22:33:51 n_hibma Exp $	*/
 
@@ -173,7 +173,8 @@ struct usbd_interface {
 	struct usbd_endpoint   *endpoints;
 	void		       *priv;
 	LIST_HEAD(, usbd_pipe)	pipes;
-	u_int8_t		claimed;
+	uint8_t			claimed;
+	uint8_t			nendpt;
 };
 
 struct usbd_pipe {