[src/netbsd-6-1]: src/sys/dev/usb Pull up following revision(s) (requested by...

[msaitoh <msaitoh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1c182d0ec679
branches:  netbsd-6-1
changeset: 775970:1c182d0ec679
user:      msaitoh <msaitoh%NetBSD.org@localhost>
date:      Thu Aug 07 08:05:24 2014 +0000

description:
Pull up following revision(s) (requested by skrll in ticket #1094):
        sys/dev/usb/if_urndis.c: revision 1.7
PR/48963: kmem_free size mismatch causes panic when attaching urndis(4).
Fix the size passed in kmem_free in the urndis_ctrl_{query,set} functions

diffstat:

 sys/dev/usb/if_urndis.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (36 lines):

diff -r e57a99a77f77 -r 1c182d0ec679 sys/dev/usb/if_urndis.c
--- a/sys/dev/usb/if_urndis.c   Thu Aug 07 06:59:33 2014 +0000
+++ b/sys/dev/usb/if_urndis.c   Thu Aug 07 08:05:24 2014 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_urndis.c,v 1.3.2.1 2012/11/24 04:01:21 riz Exp $ */
+/*     $NetBSD: if_urndis.c,v 1.3.2.1.2.1 2014/08/07 08:05:24 msaitoh Exp $ */
 /*     $OpenBSD: if_urndis.c,v 1.31 2011/07/03 15:47:17 matthew Exp $ */
 
 /*
@@ -21,7 +21,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_urndis.c,v 1.3.2.1 2012/11/24 04:01:21 riz Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_urndis.c,v 1.3.2.1.2.1 2014/08/07 08:05:24 msaitoh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -513,7 +513,7 @@
            le32toh(msg->rm_devicevchdl)));
 
        rval = urndis_ctrl_send(sc, msg, sizeof(*msg));
-       kmem_free(msg, sizeof(*msg));
+       kmem_free(msg, sizeof(*msg) + qlen);
 
        if (rval != RNDIS_STATUS_SUCCESS) {
                printf("%s: query failed\n", DEVNAME(sc));
@@ -566,7 +566,7 @@
            le32toh(msg->rm_devicevchdl)));
 
        rval = urndis_ctrl_send(sc, msg, sizeof(*msg));
-       kmem_free(msg, sizeof(*msg));
+       kmem_free(msg, sizeof(*msg) + len);
 
        if (rval != RNDIS_STATUS_SUCCESS) {
                printf("%s: set failed\n", DEVNAME(sc));