A pile of sizes to free(9). In test for a few days in snapshots.

Errors will result in nice clean panic messages so we know what's wrong.
Reviewed by dhill visa natano jsg.

1 files changed, 10 insertions, 11 deletions

diff --git a/sys/dev/pci/if_wpi.c b/sys/dev/pci/if_wpi.c
index edc03dd0d76..5106d75a6b2 100644
--- a/sys/dev/pci/if_wpi.c
+++ b/sys/dev/pci/if_wpi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_wpi.c,v 1.139 2017/03/08 12:02:41 mpi Exp $	*/
+/*	$OpenBSD: if_wpi.c,v 1.140 2017/04/08 02:57:25 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2006-2008
@@ -2957,19 +2957,18 @@ wpi_read_firmware(struct wpi_softc *sc)
 {
 	struct wpi_fw_info *fw = &sc->fw;
 	const struct wpi_firmware_hdr *hdr;
-	size_t size;
 	int error;
 
 	/* Read firmware image from filesystem. */
-	if ((error = loadfirmware("wpi-3945abg", &fw->data, &size)) != 0) {
+	if ((error = loadfirmware("wpi-3945abg", &fw->data, &fw->datalen)) != 0) {
 		printf("%s: error, %d, could not read firmware %s\n",
 		    sc->sc_dev.dv_xname, error, "wpi-3945abg");
 		return error;
 	}
-	if (size < sizeof (*hdr)) {
+	if (fw->datalen < sizeof (*hdr)) {
 		printf("%s: truncated firmware header: %zu bytes\n",
-		    sc->sc_dev.dv_xname, size);
-		free(fw->data, M_DEVBUF, size);
+		    sc->sc_dev.dv_xname, fw->datalen);
+		free(fw->data, M_DEVBUF, fw->datalen);
 		return EINVAL;
 	}
 	/* Extract firmware header information. */
@@ -2989,16 +2988,16 @@ wpi_read_firmware(struct wpi_softc *sc)
 	    fw->boot.textsz > WPI_FW_BOOT_TEXT_MAXSZ ||
 	    (fw->boot.textsz & 3) != 0) {
 		printf("%s: invalid firmware header\n", sc->sc_dev.dv_xname);
-		free(fw->data, M_DEVBUF, size);
+		free(fw->data, M_DEVBUF, fw->datalen);
 		return EINVAL;
 	}
 
 	/* Check that all firmware sections fit. */
-	if (size < sizeof (*hdr) + fw->main.textsz + fw->main.datasz +
+	if (fw->datalen < sizeof (*hdr) + fw->main.textsz + fw->main.datasz +
 	    fw->init.textsz + fw->init.datasz + fw->boot.textsz) {
 		printf("%s: firmware file too short: %zu bytes\n",
-		    sc->sc_dev.dv_xname, size);
-		free(fw->data, M_DEVBUF, size);
+		    sc->sc_dev.dv_xname, fw->datalen);
+		free(fw->data, M_DEVBUF, fw->datalen);
 		return EINVAL;
 	}
 
@@ -3290,7 +3289,7 @@ wpi_init(struct ifnet *ifp)
 
 	/* Initialize hardware and upload firmware. */
 	error = wpi_hw_init(sc);
-	free(sc->fw.data, M_DEVBUF, 0);
+	free(sc->fw.data, M_DEVBUF, sc->fw.datalen);
 	if (error != 0) {
 		printf("%s: could not initialize hardware\n",
 		    sc->sc_dev.dv_xname);