Source-Changes-HG archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

[src/netbsd-6-0]: src/sys Pull up following revision(s) (requested by riastra...



details:   https://anonhg.NetBSD.org/src/rev/e311f10e7368
branches:  netbsd-6-0
changeset: 775002:e311f10e7368
user:      msaitoh <msaitoh%NetBSD.org@localhost>
date:      Mon Nov 03 15:13:30 2014 +0000

description:
Pull up following revision(s) (requested by riastradh in ticket #1117):
        sys/dev/rasops/rasops.c: revision 1.72
        sys/dev/vme/if_ie_vme.c: revision 1.31
        sys/dev/qbus/if_qe.c: revision 1.73
        sys/altq/altq_jobs.c: revision 1.7
        sys/net/if_gre.c: revision 1.160
        sys/dev/ic/oosiop.c: revision 1.14
- Fix error branches in altq_jobs.c to avoid leaks, noted by maxv@.
- Fix leaks in oosiop_alloc_cb error branches, noted by maxv@.
  While here, avoid a sketchy pointer cast that probably falls afoul of
  strict aliasing rules. Compile-tested only, with hppa.
- Don't leak f on failurein rasops.c.  Noted by maxv@.
  Compile-tested only, with zaurus.
- Avoid leak in error branch in if_qe.c, noted by maxv@, compile-tested for
  vax.
- Sizeof struct ievme, not sizeof size_t in if_ie_vme.c.
  Noted by maxv@, compile-tested for sparc.
- Don't leak in gre_clone_create error branch.
  Noted by maxv@, compile-tested for amd64.

diffstat:

 sys/altq/altq_jobs.c    |  27 +++++++++++++-----
 sys/dev/ic/oosiop.c     |  70 ++++++++++++++++++++++++++++++++----------------
 sys/dev/qbus/if_qe.c    |  18 +++++++----
 sys/dev/rasops/rasops.c |  13 ++++++--
 sys/dev/vme/if_ie_vme.c |   6 ++--
 sys/net/if_gre.c        |  17 +++++++----
 6 files changed, 100 insertions(+), 51 deletions(-)

diffs (truncated from 391 to 300 lines):

diff -r 049620989da0 -r e311f10e7368 sys/altq/altq_jobs.c
--- a/sys/altq/altq_jobs.c      Mon Nov 03 13:03:53 2014 +0000
+++ b/sys/altq/altq_jobs.c      Mon Nov 03 15:13:30 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: altq_jobs.c,v 1.6 2010/04/09 19:32:45 plunky Exp $     */
+/*     $NetBSD: altq_jobs.c,v 1.6.20.1 2014/11/03 15:13:31 msaitoh Exp $       */
 /*     $KAME: altq_jobs.c,v 1.11 2005/04/13 03:44:25 suz Exp $ */
 /*
  * Copyright (c) 2001, the Rector and Board of Visitors of the
@@ -59,7 +59,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: altq_jobs.c,v 1.6 2010/04/09 19:32:45 plunky Exp $");
+__KERNEL_RCSID(0, "$NetBSD: altq_jobs.c,v 1.6.20.1 2014/11/03 15:13:31 msaitoh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_altq.h"
@@ -1158,7 +1158,7 @@
 
        error = update_error(jif);
        if (!error)
-               return (NULL);
+               goto fail;
 
        prop_control = (upper_bound*upper_bound*min_share)
            /(max_prod*(max_avg_pkt_size << 2));
@@ -1252,6 +1252,9 @@
                }
        }
        return result;
+
+fail:  free(result, M_DEVBUF);
+       return NULL;
 }
 
 /*
@@ -1284,19 +1287,19 @@
 
        result = malloc((jif->jif_maxpri+1)*sizeof(int64_t), M_DEVBUF, M_WAITOK);
        if (result == NULL)
-               return NULL;
+               goto fail0;
        c = malloc((jif->jif_maxpri+1)*sizeof(u_int64_t), M_DEVBUF, M_WAITOK);
        if (c == NULL)
-               return NULL;
+               goto fail1;
        n = malloc((jif->jif_maxpri+1)*sizeof(u_int64_t), M_DEVBUF, M_WAITOK);
        if (n == NULL)
-               return NULL;
+               goto fail2;
        k = malloc((jif->jif_maxpri+1)*sizeof(u_int64_t), M_DEVBUF, M_WAITOK);
        if (k == NULL)
-               return NULL;
+               goto fail3;
        available = malloc((jif->jif_maxpri+1)*sizeof(int64_t), M_DEVBUF, M_WAITOK);
        if (available == NULL)
-               return NULL;
+               goto fail4;
 
        for (i = 0; i <= jif->jif_maxpri; i++)
                result[i] = 0;
@@ -1525,6 +1528,14 @@
        free(available, M_DEVBUF);
 
        return (result);
+
+fail5: __unused
+       free(available, M_DEVBUF);
+fail4: free(k, M_DEVBUF);
+fail3: free(n, M_DEVBUF);
+fail2: free(c, M_DEVBUF);
+fail1: free(result, M_DEVBUF);
+fail0: return NULL;
 }
 
 /*
diff -r 049620989da0 -r e311f10e7368 sys/dev/ic/oosiop.c
--- a/sys/dev/ic/oosiop.c       Mon Nov 03 13:03:53 2014 +0000
+++ b/sys/dev/ic/oosiop.c       Mon Nov 03 15:13:30 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: oosiop.c,v 1.13 2010/11/13 13:52:02 uebayasi Exp $     */
+/*     $NetBSD: oosiop.c,v 1.13.20.1 2014/11/03 15:13:31 msaitoh Exp $ */
 
 /*
  * Copyright (c) 2001 Shuichiro URATA.  All rights reserved.
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: oosiop.c,v 1.13 2010/11/13 13:52:02 uebayasi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: oosiop.c,v 1.13.20.1 2014/11/03 15:13:31 msaitoh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -247,6 +247,7 @@
 oosiop_alloc_cb(struct oosiop_softc *sc, int ncb)
 {
        struct oosiop_cb *cb;
+       void *xfer_kva;
        struct oosiop_xfer *xfer;
        bus_size_t xfersize;
        bus_dma_segment_t seg;
@@ -258,7 +259,8 @@
        cb = malloc(sizeof(struct oosiop_cb) * ncb, M_DEVBUF, M_NOWAIT|M_ZERO);
        if (cb == NULL) {
                printf(": failed to allocate cb memory\n");
-               return (ENOMEM);
+               err = ENOMEM;
+               goto fail0;
        }
 
        /*
@@ -269,57 +271,79 @@
            &nseg, BUS_DMA_NOWAIT);
        if (err) {
                printf(": failed to allocate xfer block memory, err=%d\n", err);
-               return (err);
+               goto fail1;
        }
-       err = bus_dmamem_map(sc->sc_dmat, &seg, nseg, xfersize,
-           (void **)(void *)&xfer, BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
+       KASSERT(nseg == 1);
+       err = bus_dmamem_map(sc->sc_dmat, &seg, nseg, xfersize, &xfer_kva,
+           BUS_DMA_NOWAIT | BUS_DMA_COHERENT);
        if (err) {
                printf(": failed to map xfer block memory, err=%d\n", err);
-               return (err);
+               goto fail2;
        }
+       xfer = xfer_kva;
 
        /* Initialize each command block */
        for (i = 0; i < ncb; i++) {
                err = bus_dmamap_create(sc->sc_dmat, PAGE_SIZE, 1, PAGE_SIZE,
-                   0, BUS_DMA_NOWAIT, &cb->cmddma);
+                   0, BUS_DMA_NOWAIT, &cb[i].cmddma);
                if (err) {
                        printf(": failed to create cmddma map, err=%d\n", err);
-                       return (err);
+                       goto loop_fail0;
                }
                err = bus_dmamap_create(sc->sc_dmat, OOSIOP_MAX_XFER,
                    OOSIOP_NSG, OOSIOP_DBC_MAX, 0, BUS_DMA_NOWAIT,
-                   &cb->datadma);
+                   &cb[i].datadma);
                if (err) {
                        printf(": failed to create datadma map, err=%d\n", err);
-                       return (err);
+                       goto loop_fail1;
                }
 
                err = bus_dmamap_create(sc->sc_dmat,
                    sizeof(struct oosiop_xfer), 1, sizeof(struct oosiop_xfer),
-                   0, BUS_DMA_NOWAIT, &cb->xferdma);
+                   0, BUS_DMA_NOWAIT, &cb[i].xferdma);
                if (err) {
                        printf(": failed to create xfer block map, err=%d\n",
                            err);
-                       return (err);
+                       goto loop_fail2;
                }
-               err = bus_dmamap_load(sc->sc_dmat, cb->xferdma, xfer,
+               err = bus_dmamap_load(sc->sc_dmat, cb[i].xferdma, xfer,
                    sizeof(struct oosiop_xfer), NULL, BUS_DMA_NOWAIT);
                if (err) {
                        printf(": failed to load xfer block, err=%d\n", err);
-                       return (err);
+                       goto loop_fail3;
                }
 
-               cb->xfer = xfer;
+               cb[i].xfer = &xfer[i];
+               continue;
 
-               s = splbio();
-               TAILQ_INSERT_TAIL(&sc->sc_free_cb, cb, chain);
-               splx(s);
-
-               cb++;
-               xfer++;
+loop_fail4: __unused
+               bus_dmamap_unload(sc->sc_dmat, cb[i].xferdma);
+loop_fail3:    bus_dmamap_destroy(sc->sc_dmat, cb[i].xferdma);
+loop_fail2:    bus_dmamap_destroy(sc->sc_dmat, cb[i].datadma);
+loop_fail1:    bus_dmamap_destroy(sc->sc_dmat, cb[i].cmddma);
+loop_fail0:    goto fail3;
        }
 
-       return (0);
+       for (i = 0; i < ncb; i++) {
+               s = splbio();
+               TAILQ_INSERT_TAIL(&sc->sc_free_cb, &cb[i], chain);
+               splx(s);
+       }
+
+       /* Success!  */
+       return 0;
+
+fail3: while (i--) {
+               bus_dmamap_unload(sc->sc_dmat, cb[i].xferdma);
+               bus_dmamap_destroy(sc->sc_dmat, cb[i].xferdma);
+               bus_dmamap_destroy(sc->sc_dmat, cb[i].datadma);
+               bus_dmamap_destroy(sc->sc_dmat, cb[i].cmddma);
+       }
+       bus_dmamem_unmap(sc->sc_dmat, xfer_kva, xfersize);
+fail2: bus_dmamem_free(sc->sc_dmat, &seg, 1);
+fail1: free(cb, M_DEVBUF);
+fail0: KASSERT(err);
+       return err;
 }
 
 static inline void
diff -r 049620989da0 -r e311f10e7368 sys/dev/qbus/if_qe.c
--- a/sys/dev/qbus/if_qe.c      Mon Nov 03 13:03:53 2014 +0000
+++ b/sys/dev/qbus/if_qe.c      Mon Nov 03 15:13:30 2014 +0000
@@ -1,4 +1,4 @@
-/*      $NetBSD: if_qe.c,v 1.71 2010/04/05 07:21:47 joerg Exp $ */
+/*      $NetBSD: if_qe.c,v 1.71.20.1 2014/11/03 15:13:31 msaitoh Exp $ */
 /*
  * Copyright (c) 1999 Ludd, University of Lule}, Sweden. All rights reserved.
  *
@@ -38,7 +38,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_qe.c,v 1.71 2010/04/05 07:21:47 joerg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_qe.c,v 1.71.20.1 2014/11/03 15:13:31 msaitoh Exp $");
 
 #include "opt_inet.h"
 
@@ -142,7 +142,7 @@
 #define        PROBESIZE       4096
        struct qe_ring *ring;
        struct  qe_ring *rp;
-       int error;
+       int error, match;
 
        ring = malloc(PROBESIZE, M_TEMP, M_WAITOK|M_ZERO);
        memset(sc, 0, sizeof(*sc));
@@ -161,8 +161,10 @@
         */
        ui.ui_size = PROBESIZE;
        ui.ui_vaddr = (void *)&ring[0];
-       if ((error = uballoc(uh, &ui, UBA_CANTWAIT)))
-               return 0;
+       if ((error = uballoc(uh, &ui, UBA_CANTWAIT))) {
+               match = 0;
+               goto out0;
+       }
 
        /*
         * Init a simple "fake" receive and transmit descriptor that
@@ -192,12 +194,14 @@
        QE_WCSR(QE_CSR_XMTH, HIWORD(rp));
        DELAY(10000);
 
+       match = 1;
+
        /*
         * All done with the bus resources.
         */
        ubfree(uh, &ui);
-       free(ring, M_TEMP);
-       return 1;
+out0:  free(ring, M_TEMP);
+       return match;
 }
 
 /*
diff -r 049620989da0 -r e311f10e7368 sys/dev/rasops/rasops.c
--- a/sys/dev/rasops/rasops.c   Mon Nov 03 13:03:53 2014 +0000
+++ b/sys/dev/rasops/rasops.c   Mon Nov 03 15:13:30 2014 +0000
@@ -1,4 +1,4 @@
-/*      $NetBSD: rasops.c,v 1.70 2012/01/11 15:52:32 macallan Exp $    */
+/*      $NetBSD: rasops.c,v 1.70.6.1 2014/11/03 15:13:30 msaitoh Exp $ */
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rasops.c,v 1.70 2012/01/11 15:52:32 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rasops.c,v 1.70.6.1 2014/11/03 15:13:30 msaitoh Exp $");
 
 #include "opt_rasops.h"
 #include "rasops_glue.h"
@@ -1351,16 +1351,21 @@
 
        f = malloc(sizeof(struct rotatedfont), M_DEVBUF, M_WAITOK);
        if (f == NULL)
-               return;
+               goto fail0;
 
        if ((ncookie = wsfont_rotate(*cookie, rotate)) == -1)
-               return;
+               goto fail1;
 
        f->rf_cookie = *cookie;



Home | Main Index | Thread Index | Old Index