From 5ad0e8c0aeab06cc8ce3a15ee37adfe7cc17c615 Mon Sep 17 00:00:00 2001
From: Theo de Raadt <deraadt@cvs.openbsd.org>
Date: Fri, 28 Aug 2015 00:03:55 +0000
Subject: fairly simple sizes for free(); ok tedu

---
 sys/arch/amd64/amd64/aesni.c    |  4 ++--
 sys/arch/amd64/amd64/est.c      | 14 +++++++-------
 sys/arch/amd64/amd64/intr.c     |  8 ++++----
 sys/arch/amd64/amd64/mem.c      |  6 +++---
 sys/arch/amd64/amd64/softintr.c |  4 ++--
 sys/arch/amd64/amd64/via.c      |  4 ++--
 sys/arch/amd64/pci/vga_post.c   |  6 +++---
 sys/crypto/crypto.c             |  8 +++++---
 sys/dev/acpi/acpi.c             | 12 ++++++------
 sys/dev/ata/atascsi.c           | 10 +++++-----
 sys/dev/cardbus/cardbus.c       | 10 +++++-----
 sys/dev/cardbus/cardbus_exrom.c |  4 ++--
 sys/dev/ic/ac97.c               |  4 ++--
 sys/dev/ic/qla.c                |  6 +++---
 sys/dev/ic/qlw.c                |  6 +++---
 sys/dev/ic/wdc.c                |  4 ++--
 sys/dev/pci/if_rtwn.c           |  4 ++--
 sys/dev/pci/if_tht.c            |  4 ++--
 sys/dev/wscons/wsemul_dumb.c    |  4 ++--
 sys/dev/wscons/wsemul_sun.c     |  4 ++--
 sys/dev/wscons/wsemul_vt100.c   |  4 ++--
 sys/dev/wscons/wsmux.c          |  4 ++--
 sys/kern/kern_bufq.c            | 10 +++++++---
 sys/kern/kern_exit.c            |  4 ++--
 sys/kern/subr_extent.c          |  4 ++--
 sys/netinet/igmp.c              |  4 ++--
 sys/nfs/nfs_aiod.c              |  4 ++--
 sys/nfs/nfs_srvcache.c          |  4 ++--
 sys/uvm/uvm_device.c            |  6 +++---
 29 files changed, 88 insertions(+), 82 deletions(-)

diff --git a/sys/arch/amd64/amd64/aesni.c b/sys/arch/amd64/amd64/aesni.c
index 8ea76b81b5a..59f57fae09e 100644
--- a/sys/arch/amd64/amd64/aesni.c
+++ b/sys/arch/amd64/amd64/aesni.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aesni.c,v 1.32 2015/03/14 03:38:46 jsg Exp $	*/
+/*	$OpenBSD: aesni.c,v 1.33 2015/08/28 00:03:53 deraadt Exp $	*/
 /*-
  * Copyright (c) 2003 Jason Wright
  * Copyright (c) 2003, 2004 Theo de Raadt
@@ -160,7 +160,7 @@ aesni_setup(void)
 
 	aesni_sc->sc_cid = crypto_get_driverid(0);
 	if (aesni_sc->sc_cid < 0) {
-		free(aesni_sc, M_DEVBUF, 0);
+		free(aesni_sc, M_DEVBUF, sizeof(*aesni_sc));
 		return;
 	}
 
diff --git a/sys/arch/amd64/amd64/est.c b/sys/arch/amd64/amd64/est.c
index 0399615c74e..7f9900485a0 100644
--- a/sys/arch/amd64/amd64/est.c
+++ b/sys/arch/amd64/amd64/est.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: est.c,v 1.36 2015/03/14 03:38:46 jsg Exp $ */
+/*	$OpenBSD: est.c,v 1.37 2015/08/28 00:03:53 deraadt Exp $ */
 /*
  * Copyright (c) 2003 Michael Eriksson.
  * All rights reserved.
@@ -253,7 +253,7 @@ est_acpi_init()
 	return acpilist;
 
 notable:
-	free(acpilist, M_DEVBUF, 0);
+	free(acpilist, M_DEVBUF, sizeof(struct fqlist));
 	acpilist = NULL;
 nolist:
 	return NULL;
@@ -281,7 +281,7 @@ est_acpi_pss_changed(struct acpicpu_pss *pss, int npss)
 	    M_DEVBUF, M_NOWAIT)) == NULL) {
 		printf("est_acpi_pss_changed: cannot allocate memory for new "
 		    "operating points");
-		free(acpilist, M_DEVBUF, 0);
+		free(acpilist, M_DEVBUF, sizeof(struct fqlist));
 		return;
 	}
 
@@ -292,8 +292,8 @@ est_acpi_pss_changed(struct acpicpu_pss *pss, int npss)
 			needtran = 0;
 	}
 
-	free(est_fqlist->table, M_DEVBUF, 0);
-	free(est_fqlist, M_DEVBUF, 0);
+	free(est_fqlist->table, M_DEVBUF, npss * sizeof(struct est_op));
+	free(est_fqlist, M_DEVBUF, sizeof(struct fqlist));
 	est_fqlist = acpilist;
 
 	if (needtran) {
@@ -381,7 +381,7 @@ est_init(struct cpu_info *ci)
 
 		if ((fake_table = malloc(sizeof(struct est_op) * 3, M_DEVBUF,
 		     M_NOWAIT)) == NULL) {
-			free(fake_fqlist, M_DEVBUF, 0);
+			free(fake_fqlist, M_DEVBUF, sizeof(struct fqlist));
 			printf("%s: EST: cannot allocate memory for fake "
 			    "table\n", cpu_device);
 			return;
@@ -442,7 +442,7 @@ est_init(struct cpu_info *ci)
 
 nospeedstep:
 	free(est_fqlist->table, M_DEVBUF, 0);
-	free(est_fqlist, M_DEVBUF, 0);
+	free(est_fqlist, M_DEVBUF, sizeof(*est_fqlist));
 }
 
 void
diff --git a/sys/arch/amd64/amd64/intr.c b/sys/arch/amd64/amd64/intr.c
index 4f7637c97ac..c1b9d1aa1f9 100644
--- a/sys/arch/amd64/amd64/intr.c
+++ b/sys/arch/amd64/amd64/intr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: intr.c,v 1.43 2015/07/16 05:10:14 guenther Exp $	*/
+/*	$OpenBSD: intr.c,v 1.44 2015/08/28 00:03:53 deraadt Exp $	*/
 /*	$NetBSD: intr.c,v 1.3 2003/03/03 22:16:20 fvdl Exp $	*/
 
 /*
@@ -367,7 +367,7 @@ intr_establish(int legacy_irq, struct pic *pic, int pin, int type, int level,
 
 	if (source->is_handlers != NULL &&
 	    source->is_pic->pic_type != pic->pic_type) {
-		free(ih, M_DEVBUF, 0);
+		free(ih, M_DEVBUF, sizeof(*ih));
 		printf("intr_establish: can't share intr source between "
 		       "different PIC types (legacy_irq %d pin %d slot %d)\n",
 		    legacy_irq, pin, slot);
@@ -392,7 +392,7 @@ intr_establish(int legacy_irq, struct pic *pic, int pin, int type, int level,
 			printf("intr_establish: pic %s pin %d: can't share "
 			       "type %d with %d\n", pic->pic_name, pin,
 				source->is_type, type);
-			free(ih, M_DEVBUF, 0);
+			free(ih, M_DEVBUF, sizeof(*ih));
 			return NULL;
 		}
 		break;
@@ -507,7 +507,7 @@ intr_disestablish(struct intrhand *ih)
 	}
 
 	evcount_detach(&ih->ih_count);
-	free(ih, M_DEVBUF, 0);
+	free(ih, M_DEVBUF, sizeof(*ih));
 }
 
 int
diff --git a/sys/arch/amd64/amd64/mem.c b/sys/arch/amd64/amd64/mem.c
index 3ed095ec4c9..0f5ba528ae3 100644
--- a/sys/arch/amd64/amd64/mem.c
+++ b/sys/arch/amd64/amd64/mem.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mem.c,v 1.25 2015/06/22 18:57:26 kettenis Exp $ */
+/*	$OpenBSD: mem.c,v 1.26 2015/08/28 00:03:53 deraadt Exp $ */
 /*
  * Copyright (c) 1988 University of Utah.
  * Copyright (c) 1982, 1986, 1990, 1993
@@ -285,7 +285,7 @@ mem_ioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p)
 			if (!error)
 				error = copyout(md, mo->mo_desc,
 					nd * sizeof(struct mem_range_desc));
-			free(md, M_MEMDESC, 0);
+			free(md, M_MEMDESC, nd * sizeof(struct mem_range_desc));
 		} else {
 			nd = mem_range_softc.mr_ndesc;
 		}
@@ -299,7 +299,7 @@ mem_ioctl(dev_t dev, u_long cmd, caddr_t data, int flags, struct proc *p)
 		md->mr_owner[sizeof(md->mr_owner) - 1] = 0;
 		if (error == 0)
 			error = mem_range_attr_set(md, &mo->mo_arg[0]);
-		free(md, M_MEMDESC, 0);
+		free(md, M_MEMDESC, nd * sizeof(struct mem_range_desc));
 		break;
 	}
 	return (error);
diff --git a/sys/arch/amd64/amd64/softintr.c b/sys/arch/amd64/amd64/softintr.c
index bedc2ad512e..5a30a9c2846 100644
--- a/sys/arch/amd64/amd64/softintr.c
+++ b/sys/arch/amd64/amd64/softintr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: softintr.c,v 1.8 2015/07/16 05:10:14 guenther Exp $	*/
+/*	$OpenBSD: softintr.c,v 1.9 2015/08/28 00:03:53 deraadt Exp $	*/
 /*	$NetBSD: softintr.c,v 1.1 2003/02/26 21:26:12 fvdl Exp $	*/
 
 /*-
@@ -166,5 +166,5 @@ softintr_disestablish(void *arg)
 	}
 	mtx_leave(&si->softintr_lock);
 
-	free(sih, M_DEVBUF, 0);
+	free(sih, M_DEVBUF, sizeof(*sih));
 }
diff --git a/sys/arch/amd64/amd64/via.c b/sys/arch/amd64/amd64/via.c
index 9a915f1a9d4..f631f5aa303 100644
--- a/sys/arch/amd64/amd64/via.c
+++ b/sys/arch/amd64/amd64/via.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: via.c,v 1.20 2015/03/14 03:38:46 jsg Exp $	*/
+/*	$OpenBSD: via.c,v 1.21 2015/08/28 00:03:53 deraadt Exp $	*/
 /*	$NetBSD: machdep.c,v 1.214 1996/11/10 03:16:17 thorpej Exp $	*/
 
 /*-
@@ -116,7 +116,7 @@ viac3_crypto_setup(void)
 
 	vc3_sc->sc_cid = crypto_get_driverid(0);
 	if (vc3_sc->sc_cid < 0) {
-		free(vc3_sc, M_DEVBUF, 0);
+		free(vc3_sc, M_DEVBUF, sizeof(*vc3_sc));
 		return;		/* YYY bitch? */
 	}
 
diff --git a/sys/arch/amd64/pci/vga_post.c b/sys/arch/amd64/pci/vga_post.c
index 076eeb5b07c..32876649ddd 100644
--- a/sys/arch/amd64/pci/vga_post.c
+++ b/sys/arch/amd64/pci/vga_post.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: vga_post.c,v 1.9 2015/03/14 03:38:46 jsg Exp $ */
+/* $OpenBSD: vga_post.c,v 1.10 2015/08/28 00:03:53 deraadt Exp $ */
 /* $NetBSD: vga_post.c,v 1.12 2009/03/15 21:32:36 cegger Exp $ */
 
 /*-
@@ -141,7 +141,7 @@ vga_post_init(int bus, int device, int function)
 	    &sc->ram_backing, BASE_MEMORY/PAGE_SIZE, UVM_PLA_WAITOK);
 	if (err) {
 		uvm_km_free(kernel_map, sc->sys_image, 1024 * 1024);
-		free(sc, M_DEVBUF, 0);
+		free(sc, M_DEVBUF, sizeof(*sc));
 		return NULL;
 	}
 
@@ -211,7 +211,7 @@ vga_post_free(struct vga_post *sc)
 	pmap_kremove(sc->sys_image, 1024 * 1024);
 	uvm_km_free(kernel_map, sc->sys_image, 1024 * 1024);
 	pmap_update(pmap_kernel());
-	free(sc, M_DEVBUF, 0);
+	free(sc, M_DEVBUF, sizeof(*sc));
 }
 
 #ifdef DDB
diff --git a/sys/crypto/crypto.c b/sys/crypto/crypto.c
index 8ab5563e9a9..1222d21604a 100644
--- a/sys/crypto/crypto.c
+++ b/sys/crypto/crypto.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: crypto.c,v 1.74 2015/02/09 03:15:41 dlg Exp $	*/
+/*	$OpenBSD: crypto.c,v 1.75 2015/08/28 00:03:53 deraadt Exp $	*/
 /*
  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
  *
@@ -260,9 +260,11 @@ crypto_get_driverid(u_int8_t flags)
 
 		newdrv[i].cc_sessions = 1; /* Mark */
 		newdrv[i].cc_flags = flags;
-		crypto_drivers_num *= 2;
 
-		free(crypto_drivers, M_CRYPTO_DATA, 0);
+		free(crypto_drivers, M_CRYPTO_DATA,
+		    crypto_drivers_num * sizeof(struct cryptocap));
+
+		crypto_drivers_num *= 2;
 		crypto_drivers = newdrv;
 		splx(s);
 		return i;
diff --git a/sys/dev/acpi/acpi.c b/sys/dev/acpi/acpi.c
index f4338e2ad88..f451f9ef782 100644
--- a/sys/dev/acpi/acpi.c
+++ b/sys/dev/acpi/acpi.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: acpi.c,v 1.292 2015/08/20 20:50:10 kettenis Exp $ */
+/* $OpenBSD: acpi.c,v 1.293 2015/08/28 00:03:53 deraadt Exp $ */
 /*
  * Copyright (c) 2005 Thorsten Lockert <tholo@sigmasoft.com>
  * Copyright (c) 2005 Jordan Hargrave <jordan@openbsd.org>
@@ -645,13 +645,13 @@ acpi_getpci(struct aml_node *node, void *arg)
 
 	/* Check if PCI device exists */
 	if (pci->dev > 0x1F || pci->fun > 7) {
-		free(pci, M_DEVBUF, 0);
+		free(pci, M_DEVBUF, sizeof(*pci));
 		return (1);
 	}
 	tag = pci_make_tag(pc, pci->bus, pci->dev, pci->fun);
 	reg = pci_conf_read(pc, tag, PCI_ID_REG);
 	if (PCI_VENDOR(reg) == PCI_VENDOR_INVALID) {
-		free(pci, M_DEVBUF, 0);
+		free(pci, M_DEVBUF, sizeof(*pci));
 		return (1);
 	}
 	node->pci = pci;
@@ -1555,7 +1555,7 @@ acpi_dotask(struct acpi_softc *sc)
 
 	wq->handler(wq->arg0, wq->arg1);
 
-	free(wq, M_DEVBUF, 0);
+	free(wq, M_DEVBUF, sizeof(*wq));
 
 	/* We did something */
 	return (1);	
@@ -2033,7 +2033,7 @@ acpi_foundprw(struct aml_node *node, void *arg)
 	wq->q_wakepkg = malloc(sizeof(struct aml_value), M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (wq->q_wakepkg == NULL) {
-		free(wq, M_DEVBUF, 0);
+		free(wq, M_DEVBUF, sizeof(*wq));
 		return 0;
 	}
 	dnprintf(10, "Found _PRW (%s)\n", node->parent->name);
@@ -2544,7 +2544,7 @@ acpi_thread(void *arg)
 		while(acpi_dotask(acpi_softc))
 			;
 	}
-	free(thread, M_DEVBUF, 0);
+	free(thread, M_DEVBUF, sizeof(*thread));
 
 	kthread_exit(0);
 }
diff --git a/sys/dev/ata/atascsi.c b/sys/dev/ata/atascsi.c
index bd1e83b35bd..bb825a90420 100644
--- a/sys/dev/ata/atascsi.c
+++ b/sys/dev/ata/atascsi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: atascsi.c,v 1.124 2015/05/15 10:54:26 dlg Exp $ */
+/*	$OpenBSD: atascsi.c,v 1.125 2015/08/28 00:03:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2007 David Gwynne <dlg@openbsd.org>
@@ -214,7 +214,7 @@ atascsi_detach(struct atascsi *as, int flags)
 		return (rv);
 
 	free(as->as_host_ports, M_DEVBUF, 0);
-	free(as, M_DEVBUF, 0);
+	free(as, M_DEVBUF, sizeof(*as));
 
 	return (0);
 }
@@ -434,7 +434,7 @@ atascsi_probe(struct scsi_link *link)
 
 	return (0);
 error:
-	free(ap, M_DEVBUF, 0);
+	free(ap, M_DEVBUF, sizeof(*ap));
 unsupported:
 
 	as->as_methods->ata_free(as->as_cookie, port, link->lun);
@@ -461,7 +461,7 @@ atascsi_free(struct scsi_link *link)
 		return;
 
 	ap = ahp->ahp_ports[link->lun];
-	free(ap, M_DEVBUF, 0);
+	free(ap, M_DEVBUF, sizeof(*ap));
 	ahp->ahp_ports[link->lun] = NULL;
 
 	as->as_methods->ata_free(as->as_cookie, port, link->lun);
@@ -471,7 +471,7 @@ atascsi_free(struct scsi_link *link)
 		 * free ahp itself.  this relies on the order luns are
 		 * detached in scsi_detach_target().
 		 */
-		free(ahp, M_DEVBUF, 0);
+		free(ahp, M_DEVBUF, sizeof(*ap));
 		as->as_host_ports[port] = NULL;
 	}
 }
diff --git a/sys/dev/cardbus/cardbus.c b/sys/dev/cardbus/cardbus.c
index 97ed93150b1..5af8aed42f3 100644
--- a/sys/dev/cardbus/cardbus.c
+++ b/sys/dev/cardbus/cardbus.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cardbus.c,v 1.50 2015/03/14 03:38:47 jsg Exp $	*/
+/*	$OpenBSD: cardbus.c,v 1.51 2015/08/28 00:03:53 deraadt Exp $	*/
 /*	$NetBSD: cardbus.c,v 1.24 2000/04/02 19:11:37 mycroft Exp $	*/
 
 /*
@@ -237,7 +237,7 @@ cardbus_read_tuples(struct cardbus_attach_args *ca, pcireg_t cis_ptr,
 		out:
 			while ((p = SIMPLEQ_FIRST(&rom_image)) != NULL) {
 				SIMPLEQ_REMOVE_HEAD(&rom_image, next);
-				free(p, M_DEVBUF, 0);
+				free(p, M_DEVBUF, sizeof(*p));
 			}
 			exrom = pci_conf_read(pc, tag, reg);
 			pci_conf_write(pc, tag, reg, exrom & ~1);
@@ -532,7 +532,7 @@ cardbus_attach_card(struct cardbus_softc *sc)
 			/* do not match */
 			disable_function(sc, function);
 			sc->sc_funcs[function] = NULL;
-			free(ct, M_DEVBUF, 0);
+			free(ct, M_DEVBUF, sizeof(struct cardbus_devfunc));
 		} else {
 			/* found */
 			ct->ct_device = csc;
@@ -544,7 +544,7 @@ cardbus_attach_card(struct cardbus_softc *sc)
 	 * if no functions were attached).
 	 */
 	disable_function(sc, 8);
-	free(tuple, M_TEMP, 0);
+	free(tuple, M_TEMP, 2048);
 
 	return (no_work_funcs);
 }
@@ -617,7 +617,7 @@ cardbus_detach_card(struct cardbus_softc *sc)
 		} else {
 			sc->sc_poweron_func &= ~(1 << ct->ct_func);
 			sc->sc_funcs[ct->ct_func] = NULL;
-			free(ct, M_DEVBUF, 0);
+			free(ct, M_DEVBUF, sizeof(struct cardbus_devfunc));
 		}
 	}
 
diff --git a/sys/dev/cardbus/cardbus_exrom.c b/sys/dev/cardbus/cardbus_exrom.c
index ee1b27ea952..607ad6244e3 100644
--- a/sys/dev/cardbus/cardbus_exrom.c
+++ b/sys/dev/cardbus/cardbus_exrom.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cardbus_exrom.c,v 1.6 2014/07/12 18:48:17 tedu Exp $	*/
+/*	$OpenBSD: cardbus_exrom.c,v 1.7 2015/08/28 00:03:53 deraadt Exp $	*/
 /*	$NetBSD: cardbus_exrom.c,v 1.4 2000/02/03 06:47:31 thorpej Exp $	*/
 
 /*
@@ -139,7 +139,7 @@ cardbus_read_exrom(bus_space_tag_t romt, bus_space_handle_t romh,
 		if (bus_space_subregion(romt, romh, addr,
 		    image_size, &image->romh)) {
 			DPRINTF(("%s: bus_space_subregion failed", __func__));
-			free(image, M_DEVBUF, 0);
+			free(image, M_DEVBUF, sizeof(*image));
 			return (1);
 		}
 		SIMPLEQ_INSERT_TAIL(head, image, next);
diff --git a/sys/dev/ic/ac97.c b/sys/dev/ic/ac97.c
index c3429f50f97..7c0bc2dbee7 100644
--- a/sys/dev/ic/ac97.c
+++ b/sys/dev/ic/ac97.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ac97.c,v 1.80 2015/05/11 06:46:21 ratchov Exp $	*/
+/*	$OpenBSD: ac97.c,v 1.81 2015/08/28 00:03:53 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1999, 2000 Constantine Sapuntzakis
@@ -815,7 +815,7 @@ ac97_attach(struct ac97_host_if *host_if)
 	as->host_if = host_if;
 
 	if ((error = host_if->attach(host_if->arg, &as->codec_if))) {
-		free(as, M_DEVBUF, 0);
+		free(as, M_DEVBUF, sizeof(*as));
 		return (error);
 	}
 
diff --git a/sys/dev/ic/qla.c b/sys/dev/ic/qla.c
index 1b5b031d7f1..310c0d067c5 100644
--- a/sys/dev/ic/qla.c
+++ b/sys/dev/ic/qla.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qla.c,v 1.51 2015/06/19 11:12:24 jmatthew Exp $ */
+/*	$OpenBSD: qla.c,v 1.52 2015/08/28 00:03:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2011 David Gwynne <dlg@openbsd.org>
@@ -2516,7 +2516,7 @@ free:
 destroy:
 	bus_dmamap_destroy(sc->sc_dmat, m->qdm_map);
 qdmfree:
-	free(m, M_DEVBUF, 0);
+	free(m, M_DEVBUF, sizeof(*m));
 
 	return (NULL);
 }
@@ -2528,7 +2528,7 @@ qla_dmamem_free(struct qla_softc *sc, struct qla_dmamem *m)
 	bus_dmamem_unmap(sc->sc_dmat, m->qdm_kva, m->qdm_size);
 	bus_dmamem_free(sc->sc_dmat, &m->qdm_seg, 1);
 	bus_dmamap_destroy(sc->sc_dmat, m->qdm_map);
-	free(m, M_DEVBUF, 0);
+	free(m, M_DEVBUF, sizeof(*m));
 }
 
 int
diff --git a/sys/dev/ic/qlw.c b/sys/dev/ic/qlw.c
index 22f039fb128..54fea1d378d 100644
--- a/sys/dev/ic/qlw.c
+++ b/sys/dev/ic/qlw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qlw.c,v 1.28 2015/03/14 03:38:47 jsg Exp $ */
+/*	$OpenBSD: qlw.c,v 1.29 2015/08/28 00:03:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2011 David Gwynne <dlg@openbsd.org>
@@ -1672,7 +1672,7 @@ free:
 destroy:
 	bus_dmamap_destroy(sc->sc_dmat, m->qdm_map);
 qdmfree:
-	free(m, M_DEVBUF, 0);
+	free(m, M_DEVBUF, sizeof(*m));
 
 	return (NULL);
 }
@@ -1684,7 +1684,7 @@ qlw_dmamem_free(struct qlw_softc *sc, struct qlw_dmamem *m)
 	bus_dmamem_unmap(sc->sc_dmat, m->qdm_kva, m->qdm_size);
 	bus_dmamem_free(sc->sc_dmat, &m->qdm_seg, 1);
 	bus_dmamap_destroy(sc->sc_dmat, m->qdm_map);
-	free(m, M_DEVBUF, 0);
+	free(m, M_DEVBUF, sizeof(*m));
 }
 
 int
diff --git a/sys/dev/ic/wdc.c b/sys/dev/ic/wdc.c
index df8d25146dc..fdc08058fd5 100644
--- a/sys/dev/ic/wdc.c
+++ b/sys/dev/ic/wdc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wdc.c,v 1.129 2015/08/17 15:36:29 krw Exp $	*/
+/*	$OpenBSD: wdc.c,v 1.130 2015/08/28 00:03:53 deraadt Exp $	*/
 /*	$NetBSD: wdc.c,v 1.68 1999/06/23 19:00:17 bouyer Exp $	*/
 /*
  * Copyright (c) 1998, 2001 Manuel Bouyer.  All rights reserved.
@@ -731,7 +731,7 @@ wdc_alloc_queue(void)
 void
 wdc_free_queue(struct channel_queue *queue)
 {
-	free(queue, M_DEVBUF, 0);
+	free(queue, M_DEVBUF, sizeof(*queue));
 }
 
 void
diff --git a/sys/dev/pci/if_rtwn.c b/sys/dev/pci/if_rtwn.c
index 9b669293760..1d772a58eba 100644
--- a/sys/dev/pci/if_rtwn.c
+++ b/sys/dev/pci/if_rtwn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_rtwn.c,v 1.5 2015/06/14 08:02:47 stsp Exp $	*/
+/*	$OpenBSD: if_rtwn.c,v 1.6 2015/08/28 00:03:53 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -2311,7 +2311,7 @@ rtwn_load_firmware(struct rtwn_softc *sc)
 		goto fail;
 	}
  fail:
-	free(fw, M_DEVBUF, 0);
+	free(fw, M_DEVBUF, len);
 	return (error);
 }
 
diff --git a/sys/dev/pci/if_tht.c b/sys/dev/pci/if_tht.c
index e4f5c9d051d..84a67976d0e 100644
--- a/sys/dev/pci/if_tht.c
+++ b/sys/dev/pci/if_tht.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_tht.c,v 1.132 2015/06/24 09:40:54 mpi Exp $ */
+/*	$OpenBSD: if_tht.c,v 1.133 2015/08/28 00:03:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2007 David Gwynne <dlg@openbsd.org>
@@ -1717,7 +1717,7 @@ tht_fw_load(struct tht_softc *sc)
 	tht_write(sc, THT_REG_INIT_SEMAPHORE, 0x1);
 
 err:
-	free(fw, M_DEVBUF, 0);
+	free(fw, M_DEVBUF, fwlen);
 	return (error);
 }
 
diff --git a/sys/dev/wscons/wsemul_dumb.c b/sys/dev/wscons/wsemul_dumb.c
index 9c5ed2a316d..32224025b84 100644
--- a/sys/dev/wscons/wsemul_dumb.c
+++ b/sys/dev/wscons/wsemul_dumb.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsemul_dumb.c,v 1.12 2014/07/12 18:48:53 tedu Exp $ */
+/* $OpenBSD: wsemul_dumb.c,v 1.13 2015/08/28 00:03:53 deraadt Exp $ */
 /* $NetBSD: wsemul_dumb.c,v 1.7 2000/01/05 11:19:36 drochner Exp $ */
 
 /*
@@ -299,7 +299,7 @@ wsemul_dumb_detach(void *cookie, u_int *crowp, u_int *ccolp)
 	*crowp = edp->crow;
 	*ccolp = edp->ccol;
 	if (edp != &wsemul_dumb_console_emuldata)
-		free(edp, M_DEVBUF, 0);
+		free(edp, M_DEVBUF, sizeof *edp);
 }
 
 void
diff --git a/sys/dev/wscons/wsemul_sun.c b/sys/dev/wscons/wsemul_sun.c
index 6d79675a332..4d2f02d046a 100644
--- a/sys/dev/wscons/wsemul_sun.c
+++ b/sys/dev/wscons/wsemul_sun.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsemul_sun.c,v 1.31 2014/07/12 18:48:53 tedu Exp $ */
+/* $OpenBSD: wsemul_sun.c,v 1.32 2015/08/28 00:03:53 deraadt Exp $ */
 /* $NetBSD: wsemul_sun.c,v 1.11 2000/01/05 11:19:36 drochner Exp $ */
 
 /*
@@ -1062,7 +1062,7 @@ wsemul_sun_detach(void *cookie, u_int *crowp, u_int *ccolp)
 	*crowp = edp->crow;
 	*ccolp = edp->ccol;
 	if (edp != &wsemul_sun_console_emuldata)
-		free(edp, M_DEVBUF, 0);
+		free(edp, M_DEVBUF, sizeof *edp);
 }
 
 void
diff --git a/sys/dev/wscons/wsemul_vt100.c b/sys/dev/wscons/wsemul_vt100.c
index ab1df8d4e43..7f7d2e90b6c 100644
--- a/sys/dev/wscons/wsemul_vt100.c
+++ b/sys/dev/wscons/wsemul_vt100.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsemul_vt100.c,v 1.32 2014/07/12 18:48:53 tedu Exp $ */
+/* $OpenBSD: wsemul_vt100.c,v 1.33 2015/08/28 00:03:53 deraadt Exp $ */
 /* $NetBSD: wsemul_vt100.c,v 1.13 2000/04/28 21:56:16 mycroft Exp $ */
 
 /*
@@ -248,7 +248,7 @@ wsemul_vt100_detach(void *cookie, u_int *crowp, u_int *ccolp)
 	f(edp->nrctab)
 #undef f
 	if (edp != &wsemul_vt100_console_emuldata)
-		free(edp, M_DEVBUF, 0);
+		free(edp, M_DEVBUF, sizeof *edp);
 }
 
 void
diff --git a/sys/dev/wscons/wsmux.c b/sys/dev/wscons/wsmux.c
index 2014121b3b1..c1a3f978fac 100644
--- a/sys/dev/wscons/wsmux.c
+++ b/sys/dev/wscons/wsmux.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wsmux.c,v 1.29 2015/03/14 03:38:50 jsg Exp $	*/
+/*	$OpenBSD: wsmux.c,v 1.30 2015/08/28 00:03:53 deraadt Exp $	*/
 /*      $NetBSD: wsmux.c,v 1.37 2005/04/30 03:47:12 augustss Exp $      */
 
 /*
@@ -145,7 +145,7 @@ wsmux_getmux(int n)
 		wsmuxdevs = new;
 		nwsmux = n + 1;
 		if (old != NULL)
-			free(old, M_DEVBUF, 0);
+			free(old, M_DEVBUF, nwsmux * sizeof(*wsmuxdevs));
 	}
 
 	sc = wsmuxdevs[n];
diff --git a/sys/kern/kern_bufq.c b/sys/kern/kern_bufq.c
index d819783f268..7ed83470e58 100644
--- a/sys/kern/kern_bufq.c
+++ b/sys/kern/kern_bufq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_bufq.c,v 1.30 2015/03/14 03:38:50 jsg Exp $	*/
+/*	$OpenBSD: kern_bufq.c,v 1.31 2015/08/28 00:03:53 deraadt Exp $	*/
 /*
  * Copyright (c) 2010 Thordur I. Bjornsson <thib@openbsd.org>
  * Copyright (c) 2010 David Gwynne <dlg@openbsd.org>
@@ -328,7 +328,9 @@ bufq_fifo_create(void)
 void
 bufq_fifo_destroy(void *data)
 {
-	free(data, M_DEVBUF, 0);
+	struct bufq_fifo_head	*head = data;
+	
+	free(head, M_DEVBUF, sizeof(*head));
 }
 
 void
@@ -445,7 +447,9 @@ bufq_nscan_create(void)
 void
 bufq_nscan_destroy(void *vdata)
 {
-	free(vdata, M_DEVBUF, 0);
+	struct bufq_nscan_data *data = vdata;
+
+	free(data, M_DEVBUF, sizeof(*data));
 }
 
 void
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index 7ee0872bd72..c0306617ca2 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exit.c,v 1.150 2015/08/22 20:18:49 deraadt Exp $	*/
+/*	$OpenBSD: kern_exit.c,v 1.151 2015/08/28 00:03:53 deraadt Exp $	*/
 /*	$NetBSD: kern_exit.c,v 1.39 1996/04/22 01:38:25 christos Exp $	*/
 
 /*
@@ -669,7 +669,7 @@ process_zap(struct process *pr)
 
 	KASSERT(pr->ps_refcnt == 1);
 	if (pr->ps_ptstat != NULL)
-		free(pr->ps_ptstat, M_SUBPROC, 0);
+		free(pr->ps_ptstat, M_SUBPROC, sizeof(*pr->ps_ptstat));
 	pool_put(&rusage_pool, pr->ps_ru);
 	KASSERT(TAILQ_EMPTY(&pr->ps_threads));
 	limfree(pr->ps_limit);
diff --git a/sys/kern/subr_extent.c b/sys/kern/subr_extent.c
index dd6645068e2..d123c3f0f49 100644
--- a/sys/kern/subr_extent.c
+++ b/sys/kern/subr_extent.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: subr_extent.c,v 1.56 2015/03/14 03:38:50 jsg Exp $	*/
+/*	$OpenBSD: subr_extent.c,v 1.57 2015/08/28 00:03:53 deraadt Exp $	*/
 /*	$NetBSD: subr_extent.c,v 1.7 1996/11/21 18:46:34 cgd Exp $	*/
 
 /*-
@@ -284,7 +284,7 @@ extent_destroy(struct extent *ex)
 
 	/* If we're not a fixed extent, free the extent descriptor itself. */
 	if ((ex->ex_flags & EXF_FIXED) == 0)
-		free(ex, ex->ex_mtype, 0);
+		free(ex, ex->ex_mtype, sizeof(*ex));
 }
 
 /*
diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c
index 3a486107f76..c25b3f7a1ba 100644
--- a/sys/netinet/igmp.c
+++ b/sys/netinet/igmp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: igmp.c,v 1.49 2015/06/16 11:09:40 mpi Exp $	*/
+/*	$OpenBSD: igmp.c,v 1.50 2015/08/28 00:03:54 deraadt Exp $	*/
 /*	$NetBSD: igmp.c,v 1.15 1996/02/13 23:41:25 christos Exp $	*/
 
 /*
@@ -198,7 +198,7 @@ rti_delete(struct ifnet *ifp)
 	for (rti = rti_head; rti != 0; rti = rti->rti_next) {
 		if (rti->rti_ifp == ifp) {
 			*prti = rti->rti_next;
-			free(rti, M_MRTABLE, 0);
+			free(rti, M_MRTABLE, sizeof(*rti));
 			break;
 		}
 		prti = &rti->rti_next;
diff --git a/sys/nfs/nfs_aiod.c b/sys/nfs/nfs_aiod.c
index 0f002b666e9..ddb595800fc 100644
--- a/sys/nfs/nfs_aiod.c
+++ b/sys/nfs/nfs_aiod.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_aiod.c,v 1.6 2014/07/12 18:43:52 tedu Exp $	*/
+/*	$OpenBSD: nfs_aiod.c,v 1.7 2015/08/28 00:03:54 deraadt Exp $	*/
 /*
  * Copyright (c) 1989, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -147,7 +147,7 @@ loop:	/* Loop around until SIGKILL */
 	goto loop;
 
 out1:
-	free(aiod, M_TEMP, 0);
+	free(aiod, M_TEMP, sizeof(*aiod));
 	nfs_numaiods--;
 	KASSERT(nfs_numaiods >= 0);
 	/* Rejust the limit of bufs to queue. See comment above. */
diff --git a/sys/nfs/nfs_srvcache.c b/sys/nfs/nfs_srvcache.c
index 6e4c2d21ef0..ee15fc49022 100644
--- a/sys/nfs/nfs_srvcache.c
+++ b/sys/nfs/nfs_srvcache.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_srvcache.c,v 1.27 2015/03/14 03:38:52 jsg Exp $	*/
+/*	$OpenBSD: nfs_srvcache.c,v 1.28 2015/08/28 00:03:54 deraadt Exp $	*/
 /*	$NetBSD: nfs_srvcache.c,v 1.12 1996/02/18 11:53:49 fvdl Exp $	*/
 
 /*
@@ -266,7 +266,7 @@ nfsrv_cleancache(void)
 		LIST_REMOVE(rp, rc_hash);
 		TAILQ_REMOVE(&nfsrvlruhead, rp, rc_lru);
 		nfsrv_cleanentry(rp);
-		free(rp, M_NFSD, 0);
+		free(rp, M_NFSD, sizeof(*rp));
 	}
 	numnfsrvcache = 0;
 }
diff --git a/sys/uvm/uvm_device.c b/sys/uvm/uvm_device.c
index 0312110925e..ae91ab2653c 100644
--- a/sys/uvm/uvm_device.c
+++ b/sys/uvm/uvm_device.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_device.c,v 1.51 2015/03/14 03:38:53 jsg Exp $	*/
+/*	$OpenBSD: uvm_device.c,v 1.52 2015/08/28 00:03:54 deraadt Exp $	*/
 /*	$NetBSD: uvm_device.c,v 1.30 2000/11/25 06:27:59 chs Exp $	*/
 
 /*
@@ -184,7 +184,7 @@ udv_attach(dev_t device, vm_prot_t accessprot, voff_t off, vsize_t size)
 		 */
 		if (lcv) {
 			mtx_leave(&udv_lock);
-			free(udv, M_TEMP, 0);
+			free(udv, M_TEMP, sizeof(*udv));
 			continue;
 		}
 
@@ -251,7 +251,7 @@ again:
 	if (udv->u_flags & UVM_DEVICE_WANTED)
 		wakeup(udv);
 	mtx_leave(&udv_lock);
-	free(udv, M_TEMP, 0);
+	free(udv, M_TEMP, sizeof(*udv));
 }
 
 
-- 
cgit v1.2.3