Switch all instances of malloc/free in the DRM to drm_alloc, drm_free

and drm_calloc.

With the recent change to check overflow in drm_calloc, this means that
all allocations that require multiplication are now checked. Also use
drm_calloc() when zeroing is needed and drop the bzero/memset
afterwards.  Finally, make drm_free() check for NULL, so we don't need
to do so every time.

ok miod@, deraadt@

22 files changed, 151 insertions, 159 deletions

diff --git a/sys/dev/pci/drm/drmP.h b/sys/dev/pci/drm/drmP.h
index 24f8c6b19b9..0db2e7d4b19 100644
--- a/sys/dev/pci/drm/drmP.h
+++ b/sys/dev/pci/drm/drmP.h
@@ -79,28 +79,29 @@
 #define DRM_KERNEL_CONTEXT    0	 /* Change drm_resctx if changed	  */
 #define DRM_RESERVED_CONTEXTS 1	 /* Change drm_resctx if changed	  */
 
-#define DRM_MEM_DMA	   0
-#define DRM_MEM_SAREA	   1
-#define DRM_MEM_DRIVER	   2
-#define DRM_MEM_MAGIC	   3
-#define DRM_MEM_IOCTLS	   4
-#define DRM_MEM_MAPS	   5
-#define DRM_MEM_BUFS	   6
-#define DRM_MEM_SEGS	   7
-#define DRM_MEM_PAGES	   8
-#define DRM_MEM_FILES	  9
-#define DRM_MEM_QUEUES	  10
-#define DRM_MEM_CMDS	  11
-#define DRM_MEM_MAPPINGS  12
-#define DRM_MEM_BUFLISTS  13
-#define DRM_MEM_AGPLISTS  14
-#define DRM_MEM_TOTALAGP  15
-#define DRM_MEM_BOUNDAGP  16
-#define DRM_MEM_CTXBITMAP 17
-#define DRM_MEM_STUB	  18
-#define DRM_MEM_SGLISTS	  19
-#define DRM_MEM_DRAWABLE  20
-#define DRM_MEM_MM	21
+#define DRM_MEM_DMA		0
+#define DRM_MEM_SAREA		1
+#define DRM_MEM_DRIVER		2
+#define DRM_MEM_MAGIC		3
+#define DRM_MEM_IOCTLS		4
+#define DRM_MEM_MAPS		5
+#define DRM_MEM_BUFS		6
+#define DRM_MEM_SEGS		7
+#define DRM_MEM_PAGES		8
+#define DRM_MEM_FILES		9
+#define DRM_MEM_QUEUES		10
+#define DRM_MEM_CMDS		11
+#define DRM_MEM_MAPPINGS	12
+#define DRM_MEM_BUFLISTS	13
+#define DRM_MEM_AGPLISTS	14
+#define DRM_MEM_TOTALAGP	15
+#define DRM_MEM_BOUNDAGP	16
+#define DRM_MEM_CTXBITMAP	17
+#define DRM_MEM_CTXLIST		18
+#define DRM_MEM_STUB		19
+#define DRM_MEM_SGLISTS		20
+#define DRM_MEM_DRAWABLE	21
+#define DRM_MEM_MM		22
 
 #define DRM_MAX_CTXBITMAP (PAGE_SIZE * 8)
 
@@ -371,7 +372,6 @@ typedef struct drm_dma_handle {
 	bus_dmamap_t	dmamap;
 	bus_dma_segment_t seg;
 	void *addr;
-	bus_addr_t dmaaddr;
 	size_t size;
 } drm_dma_handle_t;
 
diff --git a/sys/dev/pci/drm/drm_agpsupport.c b/sys/dev/pci/drm/drm_agpsupport.c
index fe5273651cc..cada9cf8090 100644
--- a/sys/dev/pci/drm/drm_agpsupport.c
+++ b/sys/dev/pci/drm/drm_agpsupport.c
@@ -192,7 +192,7 @@ drm_agp_alloc(struct drm_device *dev, drm_agp_buffer_t *request)
 	if (!dev->agp || !dev->agp->acquired)
 		return EINVAL;
 
-	entry = malloc(sizeof(*entry), M_DRM, M_NOWAIT | M_ZERO);
+	entry = drm_alloc(sizeof(*entry), DRM_MEM_AGPLISTS);
 	if (entry == NULL)
 		return ENOMEM;
 
@@ -203,7 +203,7 @@ drm_agp_alloc(struct drm_device *dev, drm_agp_buffer_t *request)
 	handle = drm_agp_allocate_memory(pages, type);
 	DRM_LOCK();
 	if (handle == NULL) {
-		free(entry, M_DRM);
+		drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
 		return ENOMEM;
 	}
 	
@@ -352,7 +352,7 @@ drm_agp_free(struct drm_device *dev, drm_agp_buffer_t *request)
 	drm_agp_free_memory(entry->handle);
 	DRM_LOCK();
 
-	free(entry, M_DRM);
+	drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
 
 	return 0;
 
@@ -388,7 +388,7 @@ drm_agp_init(void)
 	DRM_DEBUG("agp_available = %d\n", agp_available);
 
 	if (agp_available) {
-		head = malloc(sizeof(*head), M_DRM, M_NOWAIT | M_ZERO);
+		head = drm_calloc(1, sizeof(*head), DRM_MEM_AGPLISTS);
 		if (head == NULL)
 			return NULL;
 		head->agpdev = agpdev;
diff --git a/sys/dev/pci/drm/drm_auth.c b/sys/dev/pci/drm/drm_auth.c
index cbe4fd88cd0..02568d915cd 100644
--- a/sys/dev/pci/drm/drm_auth.c
+++ b/sys/dev/pci/drm/drm_auth.c
@@ -70,7 +70,7 @@ drm_add_magic(struct drm_device *dev, struct drm_file *priv, drm_magic_t magic)
 
 	DRM_SPINLOCK_ASSERT(&dev->dev_lock);
 
-	if ((entry = malloc(sizeof(*entry), M_DRM, M_ZERO | M_NOWAIT)) == NULL)
+	if ((entry = drm_alloc(sizeof(*entry), DRM_MEM_MAGIC)) == NULL)
 		return (ENOMEM);
 	entry->magic = magic;
 	entry->priv = priv;
@@ -97,7 +97,7 @@ drm_remove_magic(struct drm_device *dev, drm_magic_t magic)
 	if ((pt = SPLAY_FIND(drm_magic_tree, &dev->magiclist, &key)) == NULL)
 		return (EINVAL);
 	SPLAY_REMOVE(drm_magic_tree, &dev->magiclist, pt);
-	free(pt, M_DRM);
+	drm_free(pt, sizeof(*pt), DRM_MEM_MAGIC);
 	return (0);
 }
 
diff --git a/sys/dev/pci/drm/drm_bufs.c b/sys/dev/pci/drm/drm_bufs.c
index 93b0548850b..e9973ebef27 100644
--- a/sys/dev/pci/drm/drm_bufs.c
+++ b/sys/dev/pci/drm/drm_bufs.c
@@ -160,7 +160,7 @@ drm_addmap(struct drm_device * dev, unsigned long offset, unsigned long size,
 	/* Allocate a new map structure, fill it in, and do any type-specific
 	 * initialization necessary.
 	 */
-	map = malloc(sizeof(*map), M_DRM, M_ZERO | M_NOWAIT);
+	map = drm_calloc(1, sizeof(*map), DRM_MEM_MAPS);
 	if ( !map ) {
 		DRM_LOCK();
 		return ENOMEM;
@@ -176,14 +176,14 @@ drm_addmap(struct drm_device * dev, unsigned long offset, unsigned long size,
 	    PAGE_SIZE, 0);
 	if (map->mm == NULL) {
 		DRM_ERROR("can't find free offset\n");
-		free(map, M_DRM);
+		drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 		return ENOMEM;
 	}
 	map->mm = drm_memrange_get_block(map->mm, map->size,
 	    PAGE_SIZE); 
 	if (map->mm == NULL) {
 		DRM_ERROR("can't get block\n");
-		free(map, M_DRM);
+		drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 		return ENOMEM;
 	}
 
@@ -234,7 +234,7 @@ drm_addmap(struct drm_device * dev, unsigned long offset, unsigned long size,
 			}
 		}
 		if (!TAILQ_EMPTY(&dev->agp->memory) && !valid) {
-			free(map, M_DRM);
+			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 			DRM_LOCK();
 			DRM_ERROR("invalid agp map requested\n");
 			return EACCES;
@@ -243,7 +243,7 @@ drm_addmap(struct drm_device * dev, unsigned long offset, unsigned long size,
 		break;
 	case _DRM_SCATTER_GATHER:
 		if (!dev->sg) {
-			free(map, M_DRM);
+			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 			DRM_LOCK();
 			return EINVAL;
 		}
@@ -262,7 +262,7 @@ drm_addmap(struct drm_device * dev, unsigned long offset, unsigned long size,
 			align = PAGE_SIZE;
 		map->dmah = drm_pci_alloc(dev, map->size, align, 0xfffffffful);
 		if (map->dmah == NULL) {
-			free(map, M_DRM);
+			drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 			DRM_LOCK();
 			return ENOMEM;
 		}
@@ -275,7 +275,7 @@ drm_addmap(struct drm_device * dev, unsigned long offset, unsigned long size,
 			if (dev->lock.hw_lock != NULL) {
 				DRM_UNLOCK();
 				drm_pci_free(dev, map->dmah);
-				free(map, M_DRM);
+				drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 				DRM_LOCK();
 				return EBUSY;
 			}
@@ -285,7 +285,7 @@ drm_addmap(struct drm_device * dev, unsigned long offset, unsigned long size,
 		break;
 	default:
 		DRM_ERROR("Bad map type %d\n", map->type);
-		free(map, M_DRM);
+		drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 		DRM_LOCK();
 		return EINVAL;
 	}
@@ -369,7 +369,7 @@ drm_rmmap(struct drm_device *dev, drm_local_map_t *map)
 
 	drm_memrange_put_block(map->mm);
 
-	free(map, M_DRM);
+	drm_free(map, sizeof(*map), DRM_MEM_MAPS);
 }
 
 /* Remove a map private from list and deallocate resources if the mapping
@@ -412,16 +412,19 @@ drm_cleanup_buf_error(struct drm_device *dev, drm_buf_entry_t *entry)
 		for (i = 0; i < entry->seg_count; i++) {
 			drm_pci_free(dev, entry->seglist[i]);
 		}
-		free(entry->seglist, M_DRM);
+		drm_free(entry->seglist, entry->seg_count *
+		    sizeof(*entry->seglist), DRM_MEM_BUFS);
 
 		entry->seg_count = 0;
 	}
 
    	if (entry->buf_count) {
 	   	for (i = 0; i < entry->buf_count; i++) {
-			free(entry->buflist[i].dev_private, M_DRM);
+			drm_free(entry->buflist[i].dev_private,
+			    entry->buflist[i].dev_priv_size, DRM_MEM_BUFS);
 		}
-		free(entry->buflist, M_DRM);
+		drm_free(entry->buflist, entry->buf_count *
+		    sizeof(*entry->buflist), DRM_MEM_BUFS);
 
 		entry->buf_count = 0;
 	}
@@ -493,8 +496,8 @@ drm_do_addbufs_agp(struct drm_device *dev, drm_buf_desc_t *request)
 
 	entry = &dma->bufs[order];
 
-	entry->buflist = malloc(count * sizeof(*entry->buflist), M_DRM,
-	    M_NOWAIT | M_ZERO);
+	entry->buflist = drm_calloc(count, sizeof(*entry->buflist),
+	    DRM_MEM_BUFS);
 	if ( !entry->buflist ) {
 		return ENOMEM;
 	}
@@ -519,8 +522,8 @@ drm_do_addbufs_agp(struct drm_device *dev, drm_buf_desc_t *request)
 		buf->file_priv = NULL;
 
 		buf->dev_priv_size = dev->driver.buf_priv_size;
-		buf->dev_private = malloc(buf->dev_priv_size, M_DRM,
-		    M_NOWAIT | M_ZERO);
+		buf->dev_private = drm_calloc(1, buf->dev_priv_size,
+		    DRM_MEM_BUFS);
 		if (buf->dev_private == NULL) {
 			/* Set count correctly so we free the proper amount. */
 			entry->buf_count = count;
@@ -597,25 +600,25 @@ drm_do_addbufs_pci(struct drm_device *dev, drm_buf_desc_t *request)
 
 	entry = &dma->bufs[order];
 
-	entry->buflist = malloc(count * sizeof(*entry->buflist), M_DRM,
-	    M_NOWAIT | M_ZERO);
-	entry->seglist = malloc(count * sizeof(*entry->seglist), M_DRM,
-	    M_NOWAIT | M_ZERO);
+	entry->buflist = drm_calloc(count, sizeof(*entry->buflist),
+	    DRM_MEM_BUFS);
+	entry->seglist = drm_calloc(count, sizeof(*entry->seglist),
+	    DRM_MEM_BUFS);
 
 	/* Keep the original pagelist until we know all the allocations
 	 * have succeeded
 	 */
-	temp_pagelist = malloc((dma->page_count + (count << page_order)) *
-	    sizeof(*dma->pagelist), M_DRM, M_NOWAIT);
+	temp_pagelist = drm_calloc((dma->page_count + (count << page_order)),
+	    sizeof(*dma->pagelist), DRM_MEM_BUFS);
 
 	if (entry->buflist == NULL || entry->seglist == NULL || 
 	    temp_pagelist == NULL) {
-		if (temp_pagelist)
-			free(temp_pagelist, M_DRM);
-		if (entry->seglist)
-			free(entry->seglist, M_DRM);
-		if (entry->buflist)
-			free(entry->buflist, M_DRM);
+		drm_free(temp_pagelist, (dma->page_count + (count <<
+		    page_order)) * sizeof(*dma->pagelist), DRM_MEM_BUFS);
+		drm_free(entry->seglist, count * sizeof(*entry->seglist),
+		    DRM_MEM_BUFS);
+		drm_free(entry->buflist, count * sizeof(*entry->buflist),
+		    DRM_MEM_BUFS);
 		return ENOMEM;
 	}
 
@@ -638,7 +641,9 @@ drm_do_addbufs_pci(struct drm_device *dev, drm_buf_desc_t *request)
 			entry->buf_count = count;
 			entry->seg_count = count;
 			drm_cleanup_buf_error(dev, entry);
-			free(temp_pagelist, M_DRM);
+			drm_free(temp_pagelist, (dma->page_count +
+			   (count << page_order)) * sizeof(*dma->pagelist),
+			   DRM_MEM_BUFS);
 			return ENOMEM;
 		}
 
@@ -666,14 +671,17 @@ drm_do_addbufs_pci(struct drm_device *dev, drm_buf_desc_t *request)
 			buf->file_priv    = NULL;
 
 			buf->dev_priv_size = dev->driver.buf_priv_size;
-			buf->dev_private = malloc(buf->dev_priv_size, M_DRM,
-			    M_NOWAIT | M_ZERO);
+			buf->dev_private = drm_calloc(1, buf->dev_priv_size,
+			    DRM_MEM_BUFS);
 			if (buf->dev_private == NULL) {
 				/* Set count correctly so we free the proper amount. */
 				entry->buf_count = count;
 				entry->seg_count = count;
 				drm_cleanup_buf_error(dev, entry);
-				free(temp_pagelist, M_DRM);
+				drm_free(temp_pagelist, (dma->page_count +
+				    (count << page_order)) *
+				    sizeof(*dma->pagelist),
+				    DRM_MEM_BUFS);
 				return ENOMEM;
 			}
 
@@ -689,7 +697,9 @@ drm_do_addbufs_pci(struct drm_device *dev, drm_buf_desc_t *request)
 	if (temp_buflist == NULL) {
 		/* Free the entry because it isn't valid */
 		drm_cleanup_buf_error(dev, entry);
-		free(temp_pagelist, M_DRM);
+		drm_free(temp_pagelist, (dma->page_count +
+		    (count << page_order)) * sizeof(*dma->pagelist),
+		    DRM_MEM_BUFS);
 		return ENOMEM;
 	}
 	dma->buflist = temp_buflist;
@@ -701,7 +711,8 @@ drm_do_addbufs_pci(struct drm_device *dev, drm_buf_desc_t *request)
 	/* No allocations failed, so now we can replace the orginal pagelist
 	 * with the new one.
 	 */
-	free(dma->pagelist, M_DRM);
+	drm_free(dma->pagelist, dma->page_count * sizeof(*dma->pagelist),
+	    DRM_MEM_BUFS);
 	dma->pagelist = temp_pagelist;
 
 	dma->buf_count += entry->buf_count;
@@ -756,8 +767,8 @@ drm_do_addbufs_sg(struct drm_device *dev, drm_buf_desc_t *request)
 
 	entry = &dma->bufs[order];
 
-	entry->buflist = malloc(count * sizeof(*entry->buflist), M_DRM,
-	    M_NOWAIT | M_ZERO);
+	entry->buflist = drm_calloc(count, sizeof(*entry->buflist),
+	    DRM_MEM_BUFS);
 	if (entry->buflist == NULL)
 		return ENOMEM;
 
@@ -781,8 +792,8 @@ drm_do_addbufs_sg(struct drm_device *dev, drm_buf_desc_t *request)
 		buf->file_priv = NULL;
 
 		buf->dev_priv_size = dev->driver.buf_priv_size;
-		buf->dev_private = malloc(buf->dev_priv_size, M_DRM,
-		    M_NOWAIT | M_ZERO);
+		buf->dev_private = drm_calloc(1, buf->dev_priv_size,
+		    DRM_MEM_BUFS);
 		if (buf->dev_private == NULL) {
 			/* Set count correctly so we free the proper amount. */
 			entry->buf_count = count;
diff --git a/sys/dev/pci/drm/drm_context.c b/sys/dev/pci/drm/drm_context.c
index 85ea2417626..fcf0d2552f6 100644
--- a/sys/dev/pci/drm/drm_context.c
+++ b/sys/dev/pci/drm/drm_context.c
@@ -90,8 +90,8 @@ drm_ctxbitmap_next(struct drm_device *dev)
 			dev->context_sareas[bit] = NULL;
 		} else {
 			/* max_context == 1 at this point */
-			dev->context_sareas = malloc(dev->max_context * 
-			    sizeof(*dev->context_sareas), M_DRM, M_NOWAIT);
+			dev->context_sareas = drm_calloc(dev->max_context, 
+			    sizeof(*dev->context_sareas), DRM_MEM_CTXLIST);
 			if (dev->context_sareas == NULL) {
 				clear_bit(bit, dev->ctx_bitmap);
 				DRM_UNLOCK();
@@ -111,7 +111,7 @@ drm_ctxbitmap_init(struct drm_device *dev)
    	int temp;
 
 	DRM_LOCK();
-	dev->ctx_bitmap = malloc(PAGE_SIZE, M_DRM, M_NOWAIT | M_ZERO);
+	dev->ctx_bitmap = drm_calloc(1, PAGE_SIZE, DRM_MEM_CTXBITMAP);
 	if ( dev->ctx_bitmap == NULL ) {
 		DRM_UNLOCK();
 		return ENOMEM;
@@ -132,9 +132,9 @@ void
 drm_ctxbitmap_cleanup(struct drm_device *dev)
 {
 	DRM_LOCK();
-	if (dev->context_sareas != NULL)
-		free(dev->context_sareas, M_DRM);
-	free(dev->ctx_bitmap, M_DRM);
+	drm_free(dev->context_sareas,
+	    sizeof(dev->context_sareas) * dev->max_context, DRM_MEM_CTXLIST);
+	drm_free(dev->ctx_bitmap, PAGE_SIZE, DRM_MEM_CTXBITMAP);
 	DRM_UNLOCK();
 }
 
diff --git a/sys/dev/pci/drm/drm_dma.c b/sys/dev/pci/drm/drm_dma.c
index 5bb024285b4..f5bfaa82125 100644
--- a/sys/dev/pci/drm/drm_dma.c
+++ b/sys/dev/pci/drm/drm_dma.c
@@ -42,7 +42,7 @@ int
 drm_dma_setup(struct drm_device *dev)
 {
 
-	dev->dma = malloc(sizeof(*dev->dma), M_DRM, M_NOWAIT | M_ZERO);
+	dev->dma = drm_calloc(1, sizeof(*dev->dma), DRM_MEM_DRIVER);
 	if (dev->dma == NULL)
 		return ENOMEM;
 
@@ -90,7 +90,7 @@ drm_dma_takedown(struct drm_device *dev)
 	if (dma->pagelist)
 		free(dma->pagelist, M_DRM);
 	if (dev->dma)
-		free(dev->dma, M_DRM);
+		drm_free(dev->dma, sizeof(*dev->dma), DRM_MEM_DMA);
 	dev->dma = NULL;
 	DRM_SPINUNINIT(&dev->dma_lock);
 }
diff --git a/sys/dev/pci/drm/drm_drawable.c b/sys/dev/pci/drm/drm_drawable.c
index 2a63b0e5219..2c963d6ced1 100644
--- a/sys/dev/pci/drm/drm_drawable.c
+++ b/sys/dev/pci/drm/drm_drawable.c
@@ -154,7 +154,7 @@ drm_update_draw(struct drm_device *dev, void *data, struct drm_file *file_priv)
 			return 0;
 		}
 		if (info->rects == NULL) {
-			info->rects = drm_alloc(sizeof(*info->rects) *
+			info->rects = drm_calloc(sizeof(*info->rects),
 			    update->num, DRM_MEM_DRAWABLE);
 			if (info->rects == NULL) {
 				DRM_SPINUNLOCK(&dev->drw_lock);
@@ -175,15 +175,12 @@ drm_update_draw(struct drm_device *dev, void *data, struct drm_file *file_priv)
 void
 drm_drawable_free(struct drm_device *dev, struct bsd_drm_drawable_info *draw)
 {
-	if (draw) {
-		RB_REMOVE(drawable_tree, &dev->drw_head, draw);
-		if (draw->info.rects)
-			drm_free(draw->info.rects,
-			    sizeof(*draw->info.rects) * draw->info.num_rects,
-			    DRM_MEM_DRAWABLE);
-		drm_free(draw, sizeof(*draw),
-		    DRM_MEM_DRAWABLE);
-	}
+	if (draw == NULL)
+		return;
+	RB_REMOVE(drawable_tree, &dev->drw_head, draw);
+	drm_free(draw->info.rects,
+	    sizeof(*draw->info.rects) * draw->info.num_rects, DRM_MEM_DRAWABLE);
+	drm_free(draw, sizeof(*draw), DRM_MEM_DRAWABLE);
 }
 
 void
diff --git a/sys/dev/pci/drm/drm_drv.c b/sys/dev/pci/drm/drm_drv.c
index 9f5a107d068..13f7c62cc74 100644
--- a/sys/dev/pci/drm/drm_drv.c
+++ b/sys/dev/pci/drm/drm_drv.c
@@ -286,7 +286,7 @@ drm_lastclose(struct drm_device *dev)
 		drm_irq_uninstall(dev);
 
 	if ( dev->unique ) {
-		free(dev->unique, M_DRM);
+		drm_free(dev->unique, dev->unique_len + 1,  DRM_MEM_DRIVER);
 		dev->unique = NULL;
 		dev->unique_len = 0;
 	}
@@ -295,7 +295,7 @@ drm_lastclose(struct drm_device *dev)
 				/* Clear pid list */
 	while ((pt = SPLAY_ROOT(&dev->magiclist)) != NULL) {
 		SPLAY_REMOVE(drm_magic_tree, &dev->magiclist, pt);
-		free(pt, M_DRM);
+		drm_free(pt, sizeof(*pt), DRM_MEM_MAGIC);
 	}
 
 				/* Clear AGP information */
@@ -310,7 +310,7 @@ drm_lastclose(struct drm_device *dev)
 				drm_agp_unbind_memory(entry->handle);
 			drm_agp_free_memory(entry->handle);
 			TAILQ_REMOVE(&dev->agp->memory, entry, link);
-			free(entry, M_DRM);
+			drm_free(entry, sizeof(*entry), DRM_MEM_AGPLISTS);
 		}
 
 		if (dev->agp->acquired)
@@ -447,7 +447,7 @@ drm_unload(struct drm_device *dev)
 	DRM_UNLOCK();
 
 	if ( dev->agp ) {
-		free(dev->agp, M_DRM);
+		drm_free(dev->agp, sizeof(*dev->agp), DRM_MEM_AGPLISTS);
 		dev->agp = NULL;
 	}
 
@@ -596,7 +596,7 @@ drmclose(DRM_CDEV kdev, int flags, int fmt, DRM_STRUCTPROC *p)
 	if (dev->driver.postclose != NULL)
 		dev->driver.postclose(dev, file_priv);
 	TAILQ_REMOVE(&dev->files, file_priv, link);
-	free(file_priv, M_DRM);
+	drm_free(file_priv, sizeof(*file_priv), DRM_MEM_FILES);
 
 	/* ========================================================
 	 * End inline drm_release
diff --git a/sys/dev/pci/drm/drm_fops.c b/sys/dev/pci/drm/drm_fops.c
index 4684f7a330d..ebe0bd0140f 100644
--- a/sys/dev/pci/drm/drm_fops.c
+++ b/sys/dev/pci/drm/drm_fops.c
@@ -69,7 +69,7 @@ drm_open_helper(DRM_CDEV kdev, int flags, int fmt, DRM_STRUCTPROC *p,
 	if (priv) {
 		priv->refs++;
 	} else {
-		priv = malloc(sizeof(*priv), M_DRM, M_NOWAIT | M_ZERO);
+		priv = drm_calloc(1, sizeof(*priv), DRM_MEM_FILES);
 		if (priv == NULL) {
 			DRM_UNLOCK();
 			return ENOMEM;
@@ -79,7 +79,6 @@ drm_open_helper(DRM_CDEV kdev, int flags, int fmt, DRM_STRUCTPROC *p,
 
 		priv->refs = 1;
 		priv->minor = m;
-		priv->ioctl_count = 0;
 
 		/* for compatibility root is always authenticated */
 		priv->authenticated = DRM_SUSER(p);
@@ -88,7 +87,7 @@ drm_open_helper(DRM_CDEV kdev, int flags, int fmt, DRM_STRUCTPROC *p,
 			/* shared code returns -errno */
 			retcode = -dev->driver.open(dev, priv);
 			if (retcode != 0) {
-				free(priv, M_DRM);
+				drm_free(priv, sizeof(*priv), DRM_MEM_FILES);
 				DRM_UNLOCK();
 				return retcode;
 			}
@@ -96,7 +95,7 @@ drm_open_helper(DRM_CDEV kdev, int flags, int fmt, DRM_STRUCTPROC *p,
 
 		/* first opener automatically becomes master if root */
 		if (TAILQ_EMPTY(&dev->files) && !DRM_SUSER(p)) {
-			free(priv, M_DRM);
+			drm_free(priv, sizeof(*priv), DRM_MEM_FILES);
 			DRM_UNLOCK();
 			return (EPERM);
 		}
diff --git a/sys/dev/pci/drm/drm_ioctl.c b/sys/dev/pci/drm/drm_ioctl.c
index 7f6b719154d..0b404858649 100644
--- a/sys/dev/pci/drm/drm_ioctl.c
+++ b/sys/dev/pci/drm/drm_ioctl.c
@@ -74,12 +74,12 @@ drm_setunique(struct drm_device *dev, void *data, struct drm_file *file_priv)
 	if (!u->unique_len || u->unique_len > 1024)
 		return EINVAL;
 
-	busid = malloc(u->unique_len + 1, M_DRM, M_WAITOK);
+	busid = drm_alloc(u->unique_len + 1, DRM_MEM_DRIVER);
 	if (busid == NULL)
 		return ENOMEM;
 
 	if (DRM_COPY_FROM_USER(busid, u->unique, u->unique_len)) {
-		free(busid, M_DRM);
+		drm_free(busid, u->unique_len + 1, DRM_MEM_DRIVER);
 		return EFAULT;
 	}
 	busid[u->unique_len] = '\0';
@@ -92,7 +92,7 @@ drm_setunique(struct drm_device *dev, void *data, struct drm_file *file_priv)
 #endif /* Net and Openbsd don't have sscanf in the kernel this is deprecated anyway. */
 
 	if (ret != 3) {
-		free(busid, M_DRM);
+		drm_free(busid, u->unique_len + 1, DRM_MEM_DRIVER);
 		return EINVAL;
 	}
 	domain = bus >> 8;
@@ -102,7 +102,7 @@ drm_setunique(struct drm_device *dev, void *data, struct drm_file *file_priv)
 	    (bus != dev->pci_bus) ||
 	    (slot != dev->pci_slot) ||
 	    (func != dev->pci_func)) {
-		free(busid, M_DRM);
+		drm_free(busid, u->unique_len + 1, DRM_MEM_DRIVER);
 		return EINVAL;
 	}
 
@@ -133,7 +133,7 @@ drm_set_busid(struct drm_device *dev)
 	}
 
 	dev->unique_len = 20;
-	dev->unique = malloc(dev->unique_len + 1, M_DRM, M_NOWAIT);
+	dev->unique = drm_alloc(dev->unique_len + 1, DRM_MEM_DRIVER);
 	if (dev->unique == NULL) {
 		DRM_UNLOCK();
 		return ENOMEM;
diff --git a/sys/dev/pci/drm/drm_irq.c b/sys/dev/pci/drm/drm_irq.c
index 9c216f59b04..e359abaefa7 100644
--- a/sys/dev/pci/drm/drm_irq.c
+++ b/sys/dev/pci/drm/drm_irq.c
@@ -421,11 +421,8 @@ drm_wait_vblank(struct drm_device *dev, void *data, struct drm_file *file_priv)
 
 	if (flags & _DRM_VBLANK_SIGNAL) {
 #if 0 /* disabled */
-		if (dev->vblank_suspend[crtc])
-			return (EBUSY);
-
-		drm_vbl_sig_t *vbl_sig = malloc(sizeof(drm_vbl_sig_t), M_DRM,
-		    M_NOWAIT | M_ZERO);
+		drm_vbl_sig_t *vbl_sig = drm_calloc(1, sizeof(drm_vbl_sig_t),
+		    DRM_MEM_DRIVER);
 		if (vbl_sig == NULL)
 			return ENOMEM;
 
@@ -499,7 +496,7 @@ drm_vbl_send_signals(struct drm_device *dev, int crtc)
 				psignal(p, vbl_sig->signo);
 
 			TAILQ_REMOVE(&dev->vbl_sig_list, vbl_sig, link);
-			DRM_FREE(vbl_sig,sizeof(*vbl_sig));
+			drm_free(vbl_sig, sizeof(*vbl_sig), DRM_MEM_DRIVER);
 		}
 		vbl_sig = next;
 	}
diff --git a/sys/dev/pci/drm/drm_memory.c b/sys/dev/pci/drm/drm_memory.c
index 8d999638b19..b613d27e1d6 100644
--- a/sys/dev/pci/drm/drm_memory.c
+++ b/sys/dev/pci/drm/drm_memory.c
@@ -81,7 +81,8 @@ drm_realloc(void *oldpt, size_t oldsize, size_t size, int area)
 void
 drm_free(void *pt, size_t size, int area)
 {
-	free(pt, M_DRM);
+	if (pt != NULL)
+		free(pt, M_DRM);
 }
 
 void *
diff --git a/sys/dev/pci/drm/drm_pci.c b/sys/dev/pci/drm/drm_pci.c
index 61b53edf3dc..7e205c397ac 100644
--- a/sys/dev/pci/drm/drm_pci.c
+++ b/sys/dev/pci/drm/drm_pci.c
@@ -52,7 +52,7 @@ drm_pci_alloc(struct drm_device *dev, size_t size, size_t align,
 		return NULL;
 	}
 
-	dmah = malloc(sizeof(drm_dma_handle_t), M_DRM, M_ZERO | M_NOWAIT);
+	dmah = drm_alloc(sizeof(*dmah), DRM_MEM_DMA);
 	if (dmah == NULL)
 		return NULL;
 
@@ -95,7 +95,7 @@ free:
 destroy:
 	bus_dmamap_destroy(dev->pa.pa_dmat, dmah->dmamap);
 dmahfree:
-	free(dmah, M_DRM);
+	drm_free(dmah, sizeof(*dmah), DRM_MEM_DMA);
 
 	return (NULL);
 
@@ -115,7 +115,7 @@ drm_pci_free(struct drm_device *dev, drm_dma_handle_t *dmah)
 	bus_dmamem_free(dev->pa.pa_dmat, &dmah->seg, 1);
 	bus_dmamap_destroy(dev->pa.pa_dmat, dmah->dmamap);
 
-	free(dmah, M_DRM);
+	drm_free(dmah, sizeof(*dmah), DRM_MEM_DMA);
 }
 
 /*@}*/
diff --git a/sys/dev/pci/drm/drm_scatter.c b/sys/dev/pci/drm/drm_scatter.c
index e18aa7a8ecd..6cccbeefc86 100644
--- a/sys/dev/pci/drm/drm_scatter.c
+++ b/sys/dev/pci/drm/drm_scatter.c
@@ -41,12 +41,12 @@ void	drm_sg_dmamem_free(struct drm_sg_dmamem *);
 void
 drm_sg_cleanup(drm_sg_mem_t *entry)
 {
-	if (entry) {
-		if (entry->mem)
+	if (entry != NULL) {
+		if (entry->mem != NULL)
 			drm_sg_dmamem_free(entry->mem);
-		if (entry->busaddr)
-			free(entry->busaddr, M_DRM);
-		free(entry, M_DRM);
+		drm_free(entry->busaddr,
+		    sizeof(*entry->busaddr) * entry->pages, DRM_MEM_SGLISTS);
+		drm_free(entry, sizeof(entry), DRM_MEM_SGLISTS);
 	}
 }
 
@@ -60,17 +60,17 @@ drm_sg_alloc(struct drm_device * dev, drm_scatter_gather_t * request)
 	if ( dev->sg )
 		return EINVAL;
 
-	entry = malloc(sizeof(*entry), M_DRM, M_WAITOK | M_ZERO);
-	if ( !entry )
-		return ENOMEM;
+	entry = drm_calloc(1, sizeof(*entry), DRM_MEM_SGLISTS);
+        if ( !entry )
+                return ENOMEM;
 
 	pages = round_page(request->size) / PAGE_SIZE;
 	DRM_DEBUG( "sg size=%ld pages=%ld\n", request->size, pages );
 
 	entry->pages = pages;
 
-	entry->busaddr = malloc(pages * sizeof(*entry->busaddr), M_DRM,
-	    M_WAITOK | M_ZERO);
+	entry->busaddr = drm_calloc(pages, sizeof(*entry->busaddr),
+	    DRM_MEM_SGLISTS);
 	if ( !entry->busaddr ) {
 		drm_sg_cleanup(entry);
 		return ENOMEM;
@@ -148,12 +148,12 @@ drm_sg_dmamem_alloc(struct drm_device *dev, size_t pages)
 	bus_size_t	  	 size = pages << PAGE_SHIFT;
 	int			 ret = 0;
 
-	dsd = malloc(sizeof(*dsd), M_DRM, M_NOWAIT | M_ZERO);
+	dsd = drm_calloc(1, sizeof(*dsd), DRM_MEM_SGLISTS);
 	if (dsd == NULL)
 		return (NULL);
 
-	dsd->sg_segs = malloc(sizeof(*dsd->sg_segs) * pages, M_DRM,
-	    M_NOWAIT | M_ZERO);
+	dsd->sg_segs = drm_calloc(sizeof(*dsd->sg_segs), pages,
+	    DRM_MEM_SGLISTS);
 	if (dsd->sg_segs == NULL)
 		goto dsdfree;
 
@@ -189,10 +189,10 @@ free:
 destroy:
 	bus_dmamap_destroy(dev->pa.pa_dmat, dsd->sg_map);
 segsfree:
-	free(dsd->sg_segs, M_DRM);
+	drm_free(dsd->sg_segs, sizeof(*dsd->sg_segs) * pages, DRM_MEM_SGLISTS);
 
 dsdfree:
-	free(dsd, M_DRM);
+	drm_free(dsd, sizeof(*dsd), DRM_MEM_SGLISTS);
 
 	return (NULL);
 }
@@ -204,6 +204,7 @@ drm_sg_dmamem_free(struct drm_sg_dmamem *mem)
 	bus_dmamem_unmap(mem->sg_tag, mem->sg_kva, mem->sg_size);
 	bus_dmamem_free(mem->sg_tag, mem->sg_segs, mem->sg_nsegs);
 	bus_dmamap_destroy(mem->sg_tag, mem->sg_map);
-	free(mem->sg_segs, M_DRM);
-	free(mem, M_DRM);
+	drm_free(mem->sg_segs, sizeof(*mem->sg_segs) *
+	    (mem->sg_size >> PAGE_SHIFT), DRM_MEM_SGLISTS);
+	drm_free(mem, sizeof(*mem), DRM_MEM_SGLISTS);
 }
diff --git a/sys/dev/pci/drm/i915_dma.c b/sys/dev/pci/drm/i915_dma.c
index 6690aac215d..fe2d54c4c2d 100644
--- a/sys/dev/pci/drm/i915_dma.c
+++ b/sys/dev/pci/drm/i915_dma.c
@@ -1025,12 +1025,10 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 	dev->types[8] = _DRM_STAT_SECONDARY;
 	dev->types[9] = _DRM_STAT_DMA;
 
-	dev_priv = drm_alloc(sizeof(drm_i915_private_t), DRM_MEM_DRIVER);
+	dev_priv = drm_calloc(1, sizeof(drm_i915_private_t), DRM_MEM_DRIVER);
 	if (dev_priv == NULL)
 		return -ENOMEM;
 
-	memset(dev_priv, 0, sizeof(drm_i915_private_t));
-
 	dev->dev_private = (void *)dev_priv;
 
 	/* Add register map (needed for suspend/resume) */
diff --git a/sys/dev/pci/drm/mach64_dma.c b/sys/dev/pci/drm/mach64_dma.c
index 339234fa830..1fd9e716920 100644
--- a/sys/dev/pci/drm/mach64_dma.c
+++ b/sys/dev/pci/drm/mach64_dma.c
@@ -1006,12 +1006,10 @@ static int mach64_do_dma_init(struct drm_device * dev, drm_mach64_init_t * init)
 
 	DRM_DEBUG("\n");
 
-	dev_priv = drm_alloc(sizeof(drm_mach64_private_t), DRM_MEM_DRIVER);
+	dev_priv = drm_calloc(1, sizeof(drm_mach64_private_t), DRM_MEM_DRIVER);
 	if (dev_priv == NULL)
 		return -ENOMEM;
 
-	memset(dev_priv, 0, sizeof(drm_mach64_private_t));
-
 	dev_priv->is_pci = init->is_pci;
 
 	dev_priv->fb_bpp = init->fb_bpp;
@@ -1477,10 +1475,9 @@ int mach64_init_freelist(struct drm_device * dev)
 	for (i = 0; i < dma->buf_count; i++) {
 		if ((entry =
 		     (drm_mach64_freelist_t *)
-		     drm_alloc(sizeof(drm_mach64_freelist_t),
+		     drm_calloc(1, sizeof(drm_mach64_freelist_t),
 			       DRM_MEM_BUFLISTS)) == NULL)
 			return -ENOMEM;
-		memset(entry, 0, sizeof(drm_mach64_freelist_t));
 		entry->buf = dma->buflist[i];
 		ptr = &entry->list;
 		list_add_tail(ptr, &dev_priv->free_list);
diff --git a/sys/dev/pci/drm/mga_dma.c b/sys/dev/pci/drm/mga_dma.c
index d56f4d7a7e4..dad747c0b95 100644
--- a/sys/dev/pci/drm/mga_dma.c
+++ b/sys/dev/pci/drm/mga_dma.c
@@ -254,23 +254,21 @@ static int mga_freelist_init(struct drm_device * dev, drm_mga_private_t * dev_pr
 	int i;
 	DRM_DEBUG("count=%d\n", dma->buf_count);
 
-	dev_priv->head = drm_alloc(sizeof(drm_mga_freelist_t), DRM_MEM_DRIVER);
+	dev_priv->head = drm_calloc(1, sizeof(drm_mga_freelist_t), DRM_MEM_DRIVER);
 	if (dev_priv->head == NULL)
 		return -ENOMEM;
 
-	memset(dev_priv->head, 0, sizeof(drm_mga_freelist_t));
 	SET_AGE(&dev_priv->head->age, MGA_BUFFER_USED, 0);
 
 	for (i = 0; i < dma->buf_count; i++) {
 		buf = dma->buflist[i];
 		buf_priv = buf->dev_private;
 
-		entry = drm_alloc(sizeof(drm_mga_freelist_t), DRM_MEM_DRIVER);
+		entry = drm_calloc(1, sizeof(drm_mga_freelist_t),
+		    DRM_MEM_DRIVER);
 		if (entry == NULL)
 			return -ENOMEM;
 
-		memset(entry, 0, sizeof(drm_mga_freelist_t));
-
 		entry->next = dev_priv->head->next;
 		entry->prev = dev_priv->head;
 		SET_AGE(&entry->age, MGA_BUFFER_FREE, 0);
@@ -397,12 +395,11 @@ int mga_driver_load(struct drm_device *dev, unsigned long flags)
 {
 	drm_mga_private_t *dev_priv;
 
-	dev_priv = drm_alloc(sizeof(drm_mga_private_t), DRM_MEM_DRIVER);
+	dev_priv = drm_calloc(1, sizeof(drm_mga_private_t), DRM_MEM_DRIVER);
 	if (!dev_priv)
 		return -ENOMEM;
 
 	dev->dev_private = (void *)dev_priv;
-	memset(dev_priv, 0, sizeof(drm_mga_private_t));
 
 	dev_priv->usec_timeout = MGA_DEFAULT_USEC_TIMEOUT;
 	dev_priv->chipset = flags;
diff --git a/sys/dev/pci/drm/r128_cce.c b/sys/dev/pci/drm/r128_cce.c
index 995c6f2e676..cfe02b701d6 100644
--- a/sys/dev/pci/drm/r128_cce.c
+++ b/sys/dev/pci/drm/r128_cce.c
@@ -353,12 +353,10 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init)
 
 	DRM_DEBUG("\n");
 
-	dev_priv = drm_alloc(sizeof(drm_r128_private_t), DRM_MEM_DRIVER);
+	dev_priv = drm_calloc(1, sizeof(drm_r128_private_t), DRM_MEM_DRIVER);
 	if (dev_priv == NULL)
 		return -ENOMEM;
 
-	memset(dev_priv, 0, sizeof(drm_r128_private_t));
-
 	dev_priv->is_pci = init->is_pci;
 
 	if (dev_priv->is_pci && !dev->sg) {
@@ -765,11 +763,11 @@ static int r128_freelist_init(struct drm_device * dev)
 	drm_r128_freelist_t *entry;
 	int i;
 
-	dev_priv->head = drm_alloc(sizeof(drm_r128_freelist_t), DRM_MEM_DRIVER);
+	dev_priv->head = drm_calloc(1, sizeof(drm_r128_freelist_t),
+	    DRM_MEM_DRIVER);
 	if (dev_priv->head == NULL)
 		return -ENOMEM;
 
-	memset(dev_priv->head, 0, sizeof(drm_r128_freelist_t));
 	dev_priv->head->age = R128_BUFFER_USED;
 
 	for (i = 0; i < dma->buf_count; i++) {
diff --git a/sys/dev/pci/drm/radeon_cp.c b/sys/dev/pci/drm/radeon_cp.c
index 0d47eb02859..272ab8ab3dd 100644
--- a/sys/dev/pci/drm/radeon_cp.c
+++ b/sys/dev/pci/drm/radeon_cp.c
@@ -1698,11 +1698,10 @@ int radeon_driver_load(struct drm_device *dev, unsigned long flags)
 	drm_radeon_private_t *dev_priv;
 	int ret = 0;
 
-	dev_priv = drm_alloc(sizeof(drm_radeon_private_t), DRM_MEM_DRIVER);
+	dev_priv = drm_calloc(1, sizeof(drm_radeon_private_t), DRM_MEM_DRIVER);
 	if (dev_priv == NULL)
 		return -ENOMEM;
 
-	memset(dev_priv, 0, sizeof(drm_radeon_private_t));
 	dev->dev_private = (void *)dev_priv;
 	dev_priv->flags = flags;
 
diff --git a/sys/dev/pci/drm/radeon_mem.c b/sys/dev/pci/drm/radeon_mem.c
index 1e582ee0799..fe4e7261a31 100644
--- a/sys/dev/pci/drm/radeon_mem.c
+++ b/sys/dev/pci/drm/radeon_mem.c
@@ -139,7 +139,7 @@ static int init_heap(struct mem_block **heap, int start, int size)
 	if (!blocks)
 		return -ENOMEM;
 
-	*heap = drm_alloc(sizeof(**heap), DRM_MEM_BUFS);
+	*heap = drm_calloc(1, sizeof(**heap), DRM_MEM_BUFS);
 	if (!*heap) {
 		drm_free(blocks, sizeof(*blocks), DRM_MEM_BUFS);
 		return -ENOMEM;
@@ -150,7 +150,6 @@ static int init_heap(struct mem_block **heap, int start, int size)
 	blocks->file_priv = NULL;
 	blocks->next = blocks->prev = *heap;
 
-	memset(*heap, 0, sizeof(**heap));
 	(*heap)->file_priv = (struct drm_file *) - 1;
 	(*heap)->next = (*heap)->prev = blocks;
 	return 0;
diff --git a/sys/dev/pci/drm/savage_bci.c b/sys/dev/pci/drm/savage_bci.c
index 4b8a89fea64..c4fe2819500 100644
--- a/sys/dev/pci/drm/savage_bci.c
+++ b/sys/dev/pci/drm/savage_bci.c
@@ -298,8 +298,8 @@ static int savage_dma_init(drm_savage_private_t *dev_priv)
 
 	dev_priv->nr_dma_pages = dev_priv->cmd_dma->size /
 		(SAVAGE_DMA_PAGE_SIZE*4);
-	dev_priv->dma_pages = drm_alloc(sizeof(drm_savage_dma_page_t) *
-					dev_priv->nr_dma_pages, DRM_MEM_DRIVER);
+	dev_priv->dma_pages = drm_calloc(sizeof(drm_savage_dma_page_t),
+	    dev_priv->nr_dma_pages, DRM_MEM_DRIVER);
 	if (dev_priv->dma_pages == NULL)
 		return -ENOMEM;
 
@@ -539,11 +539,10 @@ int savage_driver_load(struct drm_device *dev, unsigned long chipset)
 {
 	drm_savage_private_t *dev_priv;
 
-	dev_priv = drm_alloc(sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
+	dev_priv = drm_calloc(1, sizeof(drm_savage_private_t), DRM_MEM_DRIVER);
 	if (dev_priv == NULL)
 		return -ENOMEM;
 
-	memset(dev_priv, 0, sizeof(drm_savage_private_t));
 	dev->dev_private = (void *)dev_priv;
 
 	dev_priv->chipset = (enum savage_family)chipset;
@@ -804,7 +803,7 @@ static int savage_do_init_bci(struct drm_device *dev, drm_savage_init_t *init)
 		dev_priv->fake_dma.size = SAVAGE_FAKE_DMA_SIZE;
 		dev_priv->fake_dma.type = _DRM_SHM;
 		dev_priv->fake_dma.handle = drm_alloc(SAVAGE_FAKE_DMA_SIZE,
-						      DRM_MEM_DRIVER);
+		    DRM_MEM_DRIVER);
 		if (!dev_priv->fake_dma.handle) {
 			DRM_ERROR("could not allocate faked DMA buffer!\n");
 			savage_do_cleanup_bci(dev);
diff --git a/sys/dev/pci/drm/savage_state.c b/sys/dev/pci/drm/savage_state.c
index 1c5a0e2eace..a0e4105c538 100644
--- a/sys/dev/pci/drm/savage_state.c
+++ b/sys/dev/pci/drm/savage_state.c
@@ -987,7 +987,7 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
 	 * for locking on FreeBSD.
 	 */
 	if (cmdbuf->size) {
-		kcmd_addr = drm_alloc(cmdbuf->size * 8, DRM_MEM_DRIVER);
+		kcmd_addr = drm_calloc(cmdbuf->size, 8, DRM_MEM_DRIVER);
 		if (kcmd_addr == NULL)
 			return -ENOMEM;
 
@@ -1014,9 +1014,8 @@ int savage_bci_cmdbuf(struct drm_device *dev, void *data, struct drm_file *file_
 		cmdbuf->vb_addr = kvb_addr;
 	}
 	if (cmdbuf->nbox) {
-		kbox_addr = drm_alloc(cmdbuf->nbox *
-				      sizeof(struct drm_clip_rect),
-				      DRM_MEM_DRIVER);
+		kbox_addr = drm_calloc(cmdbuf->nbox, 
+		    sizeof(struct drm_clip_rect), DRM_MEM_DRIVER);
 		if (kbox_addr == NULL) {
 			ret = -ENOMEM;
 			goto done;