From c9a9cb3f2b173810ea69feb095f42c9028067427 Mon Sep 17 00:00:00 2001
From: pelikan <pelikan@openbsd.org>
Date: Sun, 13 Jul 2014 15:07:01 +0000
Subject: [PATCH] fill in proper sizes in free(9)

---
 sys/ufs/ext2fs/ext2fs_inode.c  |  4 ++--
 sys/ufs/ext2fs/ext2fs_lookup.c |  4 ++--
 sys/ufs/ext2fs/ext2fs_vfsops.c | 26 +++++++++++++++-----------
 3 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/sys/ufs/ext2fs/ext2fs_inode.c b/sys/ufs/ext2fs/ext2fs_inode.c
index 4722b30788e..a008d43d806 100644
--- a/sys/ufs/ext2fs/ext2fs_inode.c
+++ b/sys/ufs/ext2fs/ext2fs_inode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ext2fs_inode.c,v 1.52 2014/07/12 18:44:01 tedu Exp $	*/
+/*	$OpenBSD: ext2fs_inode.c,v 1.53 2014/07/13 15:07:01 pelikan Exp $	*/
 /*	$NetBSD: ext2fs_inode.c,v 1.24 2001/06/19 12:59:18 wiz Exp $	*/
 
 /*
@@ -519,7 +519,7 @@ ext2fs_indirtrunc(struct inode *ip, int32_t lbn, int32_t dbn, int32_t lastbn, in
 	}
 
 	if (copy != NULL) {
-		free(copy, M_TEMP, 0);
+		free(copy, M_TEMP, fs->e2fs_bsize);
 	} else {
 		bp->b_flags |= B_INVAL;
 		brelse(bp);
diff --git a/sys/ufs/ext2fs/ext2fs_lookup.c b/sys/ufs/ext2fs/ext2fs_lookup.c
index af3f89059f8..98de4ecdc92 100644
--- a/sys/ufs/ext2fs/ext2fs_lookup.c
+++ b/sys/ufs/ext2fs/ext2fs_lookup.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ext2fs_lookup.c,v 1.35 2014/07/12 18:44:01 tedu Exp $	*/
+/*	$OpenBSD: ext2fs_lookup.c,v 1.36 2014/07/13 15:07:01 pelikan Exp $	*/
 /*	$NetBSD: ext2fs_lookup.c,v 1.16 2000/08/03 20:29:26 thorpej Exp $	*/
 
 /*
@@ -188,7 +188,7 @@ ext2fs_readdir(void *v)
 		/* we need to correct uio_offset */
 		uio->uio_offset = off;
 	}
-	free(dirbuf, M_TEMP, 0);
+	free(dirbuf, M_TEMP, e2fs_count);
 	*ap->a_eofflag = ext2fs_size(VTOI(ap->a_vp)) <= uio->uio_offset;
 	return (error);
 }
diff --git a/sys/ufs/ext2fs/ext2fs_vfsops.c b/sys/ufs/ext2fs/ext2fs_vfsops.c
index 1ebe7c243fa..5db43958c55 100644
--- a/sys/ufs/ext2fs/ext2fs_vfsops.c
+++ b/sys/ufs/ext2fs/ext2fs_vfsops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ext2fs_vfsops.c,v 1.80 2014/07/13 13:28:26 pelikan Exp $	*/
+/*	$OpenBSD: ext2fs_vfsops.c,v 1.81 2014/07/13 15:07:01 pelikan Exp $	*/
 /*	$NetBSD: ext2fs_vfsops.c,v 1.1 1997/06/11 09:34:07 bouyer Exp $	*/
 
 /*
@@ -132,7 +132,7 @@ ext2fs_mountroot(void)
 	if ((error = ext2fs_mountfs(rootvp, mp, p)) != 0) {
 		mp->mnt_vfc->vfc_refcount--;
 		vfs_unbusy(mp);
-		free(mp, M_MOUNT, 0);
+		free(mp, M_MOUNT, sizeof *mp);
 		vrele(rootvp);
 		return (error);
 	}
@@ -417,7 +417,9 @@ e2fs_sbfill(struct vnode *devvp, struct m_ext2fs *fs, struct ext2fs *sb)
 
 		error = bread(devvp, fsbtodb(fs, dblk), fs->e2fs_bsize, &bp);
 		if (error) {
-			free(fs->e2fs_gd, M_UFSMNT, 0);
+			size_t gdescs_space = fs->e2fs_ngdb * fs->e2fs_bsize;
+
+			free(fs->e2fs_gd, M_UFSMNT, gdescs_space);
 			fs->e2fs_gd = NULL;
 			brelse(bp);
 			return (error);
@@ -599,8 +601,8 @@ out:
 	(void)VOP_CLOSE(devvp, ronly ? FREAD : FREAD|FWRITE, cred, p);
 	VOP_UNLOCK(devvp, 0, p);
 	if (ump) {
-		free(ump->um_e2fs, M_UFSMNT, 0);
-		free(ump, M_UFSMNT, 0);
+		free(ump->um_e2fs, M_UFSMNT, sizeof *ump->um_e2fs);
+		free(ump, M_UFSMNT, sizeof *ump);
 		mp->mnt_data = (qaddr_t)0;
 	}
 	return (error);
@@ -615,6 +617,7 @@ ext2fs_unmount(struct mount *mp, int mntflags, struct proc *p)
 	struct ufsmount *ump;
 	struct m_ext2fs *fs;
 	int error, flags;
+	size_t gdescs_space;
 
 	flags = 0;
 	if (mntflags & MNT_FORCE)
@@ -623,9 +626,10 @@ ext2fs_unmount(struct mount *mp, int mntflags, struct proc *p)
 		return (error);
 	ump = VFSTOUFS(mp);
 	fs = ump->um_e2fs;
-	if (fs->e2fs_ronly == 0 &&
-		ext2fs_cgupdate(ump, MNT_WAIT) == 0 &&
-		(fs->e2fs.e2fs_state & E2FS_ERRORS) == 0) {
+	gdescs_space = fs->e2fs_ngdb * fs->e2fs_bsize;
+
+	if (!fs->e2fs_ronly && ext2fs_cgupdate(ump, MNT_WAIT) == 0 &&
+	    (fs->e2fs.e2fs_state & E2FS_ERRORS) == 0) {
 		fs->e2fs.e2fs_state = E2FS_ISCLEAN;
 		(void) ext2fs_sbupdate(ump, MNT_WAIT);
 	}
@@ -636,9 +640,9 @@ ext2fs_unmount(struct mount *mp, int mntflags, struct proc *p)
 	error = VOP_CLOSE(ump->um_devvp, fs->e2fs_ronly ? FREAD : FREAD|FWRITE,
 	    NOCRED, p);
 	vput(ump->um_devvp);
-	free(fs->e2fs_gd, M_UFSMNT, 0);
-	free(fs, M_UFSMNT, 0);
-	free(ump, M_UFSMNT, 0);
+	free(fs->e2fs_gd, M_UFSMNT, gdescs_space);
+	free(fs, M_UFSMNT, sizeof *fs);
+	free(ump, M_UFSMNT, sizeof *ump);
 	mp->mnt_data = (qaddr_t)0;
 	mp->mnt_flag &= ~MNT_LOCAL;
 	return (error);
-- 
2.20.1