From 15ceb00b7e38c7f67ce5dfe3d775431383ae1003 Mon Sep 17 00:00:00 2001
From: tedu <tedu@openbsd.org>
Date: Sun, 13 Jul 2014 23:33:26 +0000
Subject: [PATCH] pass correct sizes to free()

---
 sys/ufs/ffs/ffs_inode.c   |  4 ++--
 sys/ufs/ffs/ffs_vfsops.c  | 14 +++++++-------
 sys/ufs/ufs/ufs_dirhash.c | 19 ++++++++++---------
 3 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/sys/ufs/ffs/ffs_inode.c b/sys/ufs/ffs/ffs_inode.c
index 28c8212971c..ae33ed56b3a 100644
--- a/sys/ufs/ffs/ffs_inode.c
+++ b/sys/ufs/ffs/ffs_inode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ffs_inode.c,v 1.71 2014/07/12 18:44:01 tedu Exp $	*/
+/*	$OpenBSD: ffs_inode.c,v 1.72 2014/07/13 23:33:26 tedu Exp $	*/
 /*	$NetBSD: ffs_inode.c,v 1.10 1996/05/11 18:27:19 mycroft Exp $	*/
 
 /*
@@ -561,7 +561,7 @@ ffs_indirtrunc(struct inode *ip, daddr_t lbn, daddr_t dbn,
 		}
 	}
 	if (copy != NULL) {
-		free(copy, M_TEMP, 0);
+		free(copy, M_TEMP, fs->fs_bsize);
 	} else {
 		bp->b_flags |= B_INVAL;
 		brelse(bp);
diff --git a/sys/ufs/ffs/ffs_vfsops.c b/sys/ufs/ffs/ffs_vfsops.c
index 40be455808e..8ad885b89d5 100644
--- a/sys/ufs/ffs/ffs_vfsops.c
+++ b/sys/ufs/ffs/ffs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ffs_vfsops.c,v 1.141 2014/07/12 18:44:01 tedu Exp $	*/
+/*	$OpenBSD: ffs_vfsops.c,v 1.142 2014/07/13 23:33:26 tedu Exp $	*/
 /*	$NetBSD: ffs_vfsops.c,v 1.19 1996/02/09 22:22:26 christos Exp $	*/
 
 /*
@@ -139,7 +139,7 @@ ffs_mountroot(void)
 	if ((error = ffs_mountfs(rootvp, mp, p)) != 0) {
 		mp->mnt_vfc->vfc_refcount--;
 		vfs_unbusy(mp);
-		free(mp, M_MOUNT, 0);
+		free(mp, M_MOUNT, sizeof(*mp));
 		vrele(swapdev_vp);
 		vrele(rootvp);
 		return (error);
@@ -907,9 +907,9 @@ out:
 	VOP_UNLOCK(devvp, 0, p);
 
 	if (ump) {
-		free(ump->um_fs, M_UFSMNT, 0);
-		free(ump, M_UFSMNT, 0);
-		mp->mnt_data = (qaddr_t)0;
+		free(ump->um_fs, M_UFSMNT, sizeof(*ump->um_fs));
+		free(ump, M_UFSMNT, sizeof(*ump));
+		mp->mnt_data = NULL;
 	}
 	return (error);
 }
@@ -1027,8 +1027,8 @@ ffs_unmount(struct mount *mp, int mntflags, struct proc *p)
 		NOCRED, p);
 	vput(ump->um_devvp);
 	free(fs->fs_csp, M_UFSMNT, 0);
-	free(fs, M_UFSMNT, 0);
-	free(ump, M_UFSMNT, 0);
+	free(fs, M_UFSMNT, sizeof(*fs));
+	free(ump, M_UFSMNT, sizeof(*ump));
 	mp->mnt_data = (qaddr_t)0;
 	mp->mnt_flag &= ~MNT_LOCAL;
 	return (error);
diff --git a/sys/ufs/ufs/ufs_dirhash.c b/sys/ufs/ufs/ufs_dirhash.c
index 9eff2f8f97a..86ebe4950da 100644
--- a/sys/ufs/ufs/ufs_dirhash.c
+++ b/sys/ufs/ufs/ufs_dirhash.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ufs_dirhash.c,v 1.27 2014/07/13 23:18:01 tedu Exp $	*/
+/* $OpenBSD: ufs_dirhash.c,v 1.28 2014/07/13 23:33:26 tedu Exp $	*/
 /*
  * Copyright (c) 2001, 2002 Ian Dowse.  All rights reserved.
  *
@@ -246,11 +246,12 @@ fail:
 		for (i = 0; i < narrays; i++)
 			if (dh->dh_hash[i] != NULL)
 				DIRHASH_BLKFREE(dh->dh_hash[i]);
-		free(dh->dh_hash, M_DIRHASH, 0);
+		free(dh->dh_hash, M_DIRHASH, narrays * sizeof(dh->dh_hash[0]));
 	}
 	if (dh->dh_blkfree != NULL)
-		free(dh->dh_blkfree, M_DIRHASH, 0);
-	free(dh, M_DIRHASH, 0);
+		free(dh->dh_blkfree, M_DIRHASH,
+		    nblocks * sizeof(dh->dh_blkfree[0]));
+	free(dh, M_DIRHASH, sizeof(*dh));
 	ip->i_dirhash = NULL;
 	DIRHASHLIST_LOCK();
 	ufs_dirhashmem -= memreqd;
@@ -282,13 +283,13 @@ ufsdirhash_free(struct inode *ip)
 	if (dh->dh_hash != NULL) {
 		for (i = 0; i < dh->dh_narrays; i++)
 			DIRHASH_BLKFREE(dh->dh_hash[i]);
-		free(dh->dh_hash, M_DIRHASH, 0);
-		free(dh->dh_blkfree, M_DIRHASH, 0);
+		free(dh->dh_hash, M_DIRHASH, dh->dh_narrays * sizeof(*dh->dh_hash));
+		free(dh->dh_blkfree, M_DIRHASH, dh->dh_nblk * sizeof(*dh->dh_blkfree));
 		mem += dh->dh_narrays * sizeof(*dh->dh_hash) +
 		    dh->dh_narrays * DH_NBLKOFF * sizeof(**dh->dh_hash) +
 		    dh->dh_nblk * sizeof(*dh->dh_blkfree);
 	}
-	free(dh, M_DIRHASH, 0);
+	free(dh, M_DIRHASH, sizeof(*dh));
 	ip->i_dirhash = NULL;
 
 	DIRHASHLIST_LOCK();
@@ -1042,8 +1043,8 @@ ufsdirhash_recycle(int wanted)
 		DIRHASHLIST_UNLOCK();
 		for (i = 0; i < narrays; i++)
 			DIRHASH_BLKFREE(hash[i]);
-		free(hash, M_DIRHASH, 0);
-		free(blkfree, M_DIRHASH, 0);
+		free(hash, M_DIRHASH, narrays * sizeof(*dh->dh_hash));
+		free(blkfree, M_DIRHASH, dh->dh_nblk * sizeof(*dh->dh_blkfree));
 
 		/* Account for the returned memory, and repeat if necessary. */
 		DIRHASHLIST_LOCK();
-- 
2.20.1