From: deraadt <deraadt@openbsd.org>
Date: Thu, 6 Apr 2017 17:00:53 +0000 (+0000)
Subject: Sizes for the remaining free() calls, and use mallocarray()
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=870d2ca81a507f61351b098ee3b90e2f88a9cbab;p=openbsd

Sizes for the remaining free() calls, and use mallocarray()
ok visa
---

diff --git a/sys/dev/sdmmc/sdmmc_io.c b/sys/dev/sdmmc/sdmmc_io.c
index ac0f19897ec..fa5b9d86c4c 100644
--- a/sys/dev/sdmmc/sdmmc_io.c
+++ b/sys/dev/sdmmc/sdmmc_io.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sdmmc_io.c,v 1.27 2016/09/11 10:22:16 mglocker Exp $	*/
+/*	$OpenBSD: sdmmc_io.c,v 1.28 2017/04/06 17:00:53 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2006 Uwe Stuehler <uwe@openbsd.org>
@@ -682,7 +682,7 @@ sdmmc_intr_disestablish(void *cookie)
 	}
 	splx(s);
 
-	free(ih, M_DEVBUF, 0);
+	free(ih, M_DEVBUF, sizeof *ih);
 }
 
 /*
diff --git a/sys/dev/sdmmc/sdmmc_scsi.c b/sys/dev/sdmmc/sdmmc_scsi.c
index 0e4c98fb2c8..7c84610a742 100644
--- a/sys/dev/sdmmc/sdmmc_scsi.c
+++ b/sys/dev/sdmmc/sdmmc_scsi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sdmmc_scsi.c,v 1.39 2017/04/06 03:15:29 deraadt Exp $	*/
+/*	$OpenBSD: sdmmc_scsi.c,v 1.40 2017/04/06 17:00:53 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2006 Uwe Stuehler <uwe@openbsd.org>
@@ -67,6 +67,7 @@ struct sdmmc_scsi_softc {
 	struct sdmmc_scsi_target *sc_tgt;
 	int sc_ntargets;
 	struct sdmmc_ccb *sc_ccbs;		/* allocated ccbs */
+	int		sc_nccbs;
 	struct sdmmc_ccb_list sc_ccb_freeq;	/* free ccbs */
 	struct sdmmc_ccb_list sc_ccb_runq;	/* queued ccbs */
 	struct mutex sc_ccb_mtx;
@@ -103,7 +104,7 @@ sdmmc_scsi_attach(struct sdmmc_softc *sc)
 
 	scbus = malloc(sizeof *scbus, M_DEVBUF, M_WAITOK | M_ZERO);
 
-	scbus->sc_tgt = malloc(sizeof(*scbus->sc_tgt) *
+	scbus->sc_tgt = mallocarray(sizeof(*scbus->sc_tgt),
 	    (SDMMC_SCSIID_MAX+1), M_DEVBUF, M_WAITOK | M_ZERO);
 
 	/*
@@ -151,7 +152,8 @@ sdmmc_scsi_attach(struct sdmmc_softc *sc)
 	sc->sc_scsibus = NULL;
 	sdmmc_free_ccbs(scbus);
  free_sctgt:
-	free(scbus->sc_tgt, M_DEVBUF, 0);
+	free(scbus->sc_tgt, M_DEVBUF,
+	    sizeof(*scbus->sc_tgt) * (SDMMC_SCSIID_MAX+1));
 	free(scbus, M_DEVBUF, sizeof *scbus);
 }
 
@@ -179,7 +181,8 @@ sdmmc_scsi_detach(struct sdmmc_softc *sc)
 		config_detach(scbus->sc_child, DETACH_FORCE);
 
 	if (scbus->sc_tgt != NULL)
-		free(scbus->sc_tgt, M_DEVBUF, 0);
+		free(scbus->sc_tgt, M_DEVBUF,
+		    sizeof(*scbus->sc_tgt) * (SDMMC_SCSIID_MAX+1));
 
 	sdmmc_free_ccbs(scbus);
 	free(scbus, M_DEVBUF, sizeof *scbus);
@@ -200,6 +203,7 @@ sdmmc_alloc_ccbs(struct sdmmc_scsi_softc *scbus, int nccbs)
 	    M_DEVBUF, M_NOWAIT);
 	if (scbus->sc_ccbs == NULL)
 		return 1;
+	scbus->sc_nccbs = nccbs;
 
 	TAILQ_INIT(&scbus->sc_ccb_freeq);
 	TAILQ_INIT(&scbus->sc_ccb_runq);
@@ -223,7 +227,8 @@ void
 sdmmc_free_ccbs(struct sdmmc_scsi_softc *scbus)
 {
 	if (scbus->sc_ccbs != NULL) {
-		free(scbus->sc_ccbs, M_DEVBUF, 0);
+		free(scbus->sc_ccbs, M_DEVBUF,
+		    scbus->sc_nccbs * sizeof(struct sdmmc_ccb));
 		scbus->sc_ccbs = NULL;
 	}
 }