Sizes for the remaining free() calls, and use mallocarray()

ok visa

diff --git a/sys/dev/sdmmc/sdmmc_io.c b/sys/dev/sdmmc/sdmmc_io.c
index ac0f198..fa5b9d8 100644 (file)
--- a/sys/dev/sdmmc/sdmmc_io.c
+++ b/sys/dev/sdmmc/sdmmc_io.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: sdmmc_io.c,v 1.27 2016/09/11 10:22:16 mglocker Exp $  */
+/*     $OpenBSD: sdmmc_io.c,v 1.28 2017/04/06 17:00:53 deraadt Exp $   */
 
 /*
  * Copyright (c) 2006 Uwe Stuehler <uwe@openbsd.org>
@@ -682,7 +682,7 @@ sdmmc_intr_disestablish(void *cookie)
        }
        splx(s);
 
-       free(ih, M_DEVBUF, 0);
+       free(ih, M_DEVBUF, sizeof *ih);
 }
 
 /*

diff --git a/sys/dev/sdmmc/sdmmc_scsi.c b/sys/dev/sdmmc/sdmmc_scsi.c
index 0e4c98f..7c84610 100644 (file)
--- a/sys/dev/sdmmc/sdmmc_scsi.c
+++ b/sys/dev/sdmmc/sdmmc_scsi.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: sdmmc_scsi.c,v 1.39 2017/04/06 03:15:29 deraadt Exp $ */
+/*     $OpenBSD: sdmmc_scsi.c,v 1.40 2017/04/06 17:00:53 deraadt Exp $ */
 
 /*
  * Copyright (c) 2006 Uwe Stuehler <uwe@openbsd.org>
@@ -67,6 +67,7 @@ struct sdmmc_scsi_softc {
        struct sdmmc_scsi_target *sc_tgt;
        int sc_ntargets;
        struct sdmmc_ccb *sc_ccbs;              /* allocated ccbs */
+       int             sc_nccbs;
        struct sdmmc_ccb_list sc_ccb_freeq;     /* free ccbs */
        struct sdmmc_ccb_list sc_ccb_runq;      /* queued ccbs */
        struct mutex sc_ccb_mtx;
@@ -103,7 +104,7 @@ sdmmc_scsi_attach(struct sdmmc_softc *sc)
 
        scbus = malloc(sizeof *scbus, M_DEVBUF, M_WAITOK | M_ZERO);
 
-       scbus->sc_tgt = malloc(sizeof(*scbus->sc_tgt) *
+       scbus->sc_tgt = mallocarray(sizeof(*scbus->sc_tgt),
            (SDMMC_SCSIID_MAX+1), M_DEVBUF, M_WAITOK | M_ZERO);
 
        /*
@@ -151,7 +152,8 @@ sdmmc_scsi_attach(struct sdmmc_softc *sc)
        sc->sc_scsibus = NULL;
        sdmmc_free_ccbs(scbus);
  free_sctgt:
-       free(scbus->sc_tgt, M_DEVBUF, 0);
+       free(scbus->sc_tgt, M_DEVBUF,
+           sizeof(*scbus->sc_tgt) * (SDMMC_SCSIID_MAX+1));
        free(scbus, M_DEVBUF, sizeof *scbus);
 }
 
@@ -179,7 +181,8 @@ sdmmc_scsi_detach(struct sdmmc_softc *sc)
                config_detach(scbus->sc_child, DETACH_FORCE);
 
        if (scbus->sc_tgt != NULL)
-               free(scbus->sc_tgt, M_DEVBUF, 0);
+               free(scbus->sc_tgt, M_DEVBUF,
+                   sizeof(*scbus->sc_tgt) * (SDMMC_SCSIID_MAX+1));
 
        sdmmc_free_ccbs(scbus);
        free(scbus, M_DEVBUF, sizeof *scbus);
@@ -200,6 +203,7 @@ sdmmc_alloc_ccbs(struct sdmmc_scsi_softc *scbus, int nccbs)
            M_DEVBUF, M_NOWAIT);
        if (scbus->sc_ccbs == NULL)
                return 1;
+       scbus->sc_nccbs = nccbs;
 
        TAILQ_INIT(&scbus->sc_ccb_freeq);
        TAILQ_INIT(&scbus->sc_ccb_runq);
@@ -223,7 +227,8 @@ void
 sdmmc_free_ccbs(struct sdmmc_scsi_softc *scbus)
 {
        if (scbus->sc_ccbs != NULL) {
-               free(scbus->sc_ccbs, M_DEVBUF, 0);
+               free(scbus->sc_ccbs, M_DEVBUF,
+                   scbus->sc_nccbs * sizeof(struct sdmmc_ccb));
                scbus->sc_ccbs = NULL;
        }
 }