A pile of sizes to free(9). In test for a few days in snapshots.

Errors will result in nice clean panic messages so we know what's wrong.
Reviewed by dhill visa natano jsg.

5 files changed, 19 insertions, 19 deletions

diff --git a/sys/dev/ic/aac.c b/sys/dev/ic/aac.c
index d7e4a33bc97..84f6d7a2670 100644
--- a/sys/dev/ic/aac.c
+++ b/sys/dev/ic/aac.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aac.c,v 1.67 2016/03/27 11:06:19 mpi Exp $	*/
+/*	$OpenBSD: aac.c,v 1.68 2017/04/08 02:57:24 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2000 Michael Smith
@@ -996,7 +996,7 @@ aac_alloc_commands(struct aac_softc *sc)
  exit_map:
 	bus_dmamem_free(sc->aac_dmat, &fm->aac_seg, fm->aac_nsegs);
  exit_alloc:
-	free(fm, M_DEVBUF, 0);
+	free(fm, M_DEVBUF, sizeof *fm);
  exit:
 	AAC_LOCK_RELEASE(&sc->aac_io_lock);
 	return (error);
@@ -1030,7 +1030,7 @@ aac_free_commands(struct aac_softc *sc)
 		bus_dmamem_unmap(sc->aac_dmat, (caddr_t)fm->aac_fibs,
 				 AAC_FIBMAP_SIZE);
 		bus_dmamem_free(sc->aac_dmat, &fm->aac_seg, fm->aac_nsegs);
-		free(fm, M_DEVBUF, 0);
+		free(fm, M_DEVBUF, sizeof *fm);
 	}
 }
 
diff --git a/sys/dev/ic/ami.c b/sys/dev/ic/ami.c
index d544684df25..3fa06417578 100644
--- a/sys/dev/ic/ami.c
+++ b/sys/dev/ic/ami.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ami.c,v 1.232 2016/08/14 04:08:03 dlg Exp $	*/
+/*	$OpenBSD: ami.c,v 1.233 2017/04/08 02:57:24 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2001 Michael Shalayeff
@@ -2293,7 +2293,7 @@ ami_ioctl_disk(struct ami_softc *sc, struct bioc_disk *bd)
 done:
 	error = 0;
 bail:
-	free(p, M_DEVBUF, 0);
+	free(p, M_DEVBUF, sizeof *p);
 	dma_free(vpdbuf, sizeof(*vpdbuf));
 	dma_free(inqbuf, sizeof(*inqbuf));
 
diff --git a/sys/dev/ic/i82365.c b/sys/dev/ic/i82365.c
index afd6285a8fb..7d34c3c1a42 100644
--- a/sys/dev/ic/i82365.c
+++ b/sys/dev/ic/i82365.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: i82365.c,v 1.34 2015/08/15 19:29:00 miod Exp $	*/
+/*	$OpenBSD: i82365.c,v 1.35 2017/04/08 02:57:25 deraadt Exp $	*/
 /*	$NetBSD: i82365.c,v 1.10 1998/06/09 07:36:55 thorpej Exp $	*/
 
 /*
@@ -469,9 +469,9 @@ pcic_event_process(h, pe)
 				break;
 			if (pe2->pe_type == PCIC_EVENT_INSERTION) {
 				SIMPLEQ_REMOVE_HEAD(&h->events, pe_q);
-				free(pe1, M_TEMP, 0);
+				free(pe1, M_TEMP, sizeof *pe1);
 				SIMPLEQ_REMOVE_HEAD(&h->events, pe_q);
-				free(pe2, M_TEMP, 0);
+				free(pe2, M_TEMP, sizeof *pe2);
 			}
 		}
 		splx(s);
@@ -493,9 +493,9 @@ pcic_event_process(h, pe)
 				break;
 			if (pe2->pe_type == PCIC_EVENT_REMOVAL) {
 				SIMPLEQ_REMOVE_HEAD(&h->events, pe_q);
-				free(pe1, M_TEMP, 0);
+				free(pe1, M_TEMP, sizeof *pe1);
 				SIMPLEQ_REMOVE_HEAD(&h->events, pe_q);
-				free(pe2, M_TEMP, 0);
+				free(pe2, M_TEMP, sizeof *pe1);
 			}
 		}
 		splx(s);
@@ -507,7 +507,7 @@ pcic_event_process(h, pe)
 	default:
 		panic("pcic_event_thread: unknown event %d", pe->pe_type);
 	}
-	free(pe, M_TEMP, 0);
+	free(pe, M_TEMP, sizeof *pe);
 }
 
 void
diff --git a/sys/dev/ic/nvme.c b/sys/dev/ic/nvme.c
index f90db0ce372..0785fbdadf5 100644
--- a/sys/dev/ic/nvme.c
+++ b/sys/dev/ic/nvme.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nvme.c,v 1.53 2016/11/15 12:17:42 mpi Exp $ */
+/*	$OpenBSD: nvme.c,v 1.54 2017/04/08 02:57:25 deraadt Exp $ */
 
 /*
  * Copyright (c) 2014 David Gwynne <dlg@openbsd.org>
@@ -1220,7 +1220,7 @@ nvme_q_alloc(struct nvme_softc *sc, u_int16_t id, u_int entries, u_int dstrd)
 free_sq:
 	nvme_dmamem_free(sc, q->q_sq_dmamem);
 free:
-	free(q, M_DEVBUF, 0);
+	free(q, M_DEVBUF, sizeof *q);
 
 	return (NULL);
 }
@@ -1232,7 +1232,7 @@ nvme_q_free(struct nvme_softc *sc, struct nvme_queue *q)
 	nvme_dmamem_sync(sc, q->q_sq_dmamem, BUS_DMASYNC_POSTWRITE);
 	nvme_dmamem_free(sc, q->q_cq_dmamem);
 	nvme_dmamem_free(sc, q->q_sq_dmamem);
-	free(q, M_DEVBUF, 0);
+	free(q, M_DEVBUF, sizeof *q);
 }
 
 int
@@ -1299,7 +1299,7 @@ free:
 destroy:
 	bus_dmamap_destroy(sc->sc_dmat, ndm->ndm_map);
 ndmfree:
-	free(ndm, M_DEVBUF, 0);
+	free(ndm, M_DEVBUF, sizeof *ndm);
 
 	return (NULL);
 }
@@ -1318,6 +1318,6 @@ nvme_dmamem_free(struct nvme_softc *sc, struct nvme_dmamem *ndm)
 	bus_dmamem_unmap(sc->sc_dmat, ndm->ndm_kva, ndm->ndm_size);
 	bus_dmamem_free(sc->sc_dmat, &ndm->ndm_seg, 1);
 	bus_dmamap_destroy(sc->sc_dmat, ndm->ndm_map);
-	free(ndm, M_DEVBUF, 0);
+	free(ndm, M_DEVBUF, sizeof *ndm);
 }
 
diff --git a/sys/dev/ic/rtw.c b/sys/dev/ic/rtw.c
index 0ced9313a23..b5d84ed78f2 100644
--- a/sys/dev/ic/rtw.c
+++ b/sys/dev/ic/rtw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtw.c,v 1.97 2017/01/22 10:17:38 dlg Exp $	*/
+/*	$OpenBSD: rtw.c,v 1.98 2017/04/08 02:57:25 deraadt Exp $	*/
 /*	$NetBSD: rtw.c,v 1.29 2004/12/27 19:49:16 dyoung Exp $ */
 
 /*-
@@ -4057,11 +4057,11 @@ rtw_attach(struct rtw_softc *sc)
 
 fail8:
 	sr = &sc->sc_srom;
-	sr->sr_size = 0;
 	if (sr->sr_content != NULL) {
-		free(sr->sr_content, M_DEVBUF, 0);
+		free(sr->sr_content, M_DEVBUF, sr->sr_size);
 		sr->sr_content = NULL;
 	}
+	sr->sr_size = 0;
 
 fail7:
 	rtw_rxdesc_dmamaps_destroy(sc->sc_dmat, &sc->sc_rxsoft[0],