[src/trunk]: src/sys/dev/raidframe PR/44207: Wolfgang.Stukenbrock:

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/d73937114f53
branches:  trunk
changeset: 759410:d73937114f53
user:      christos <christos%NetBSD.org@localhost>
date:      Wed Dec 08 16:18:06 2010 +0000

description:
PR/44207: Wolfgang.Stukenbrock:
    memory-leak in raid-ioctl(RAIDFRAME_GET_COMPONENT_LAB

diffstat:

 sys/dev/raidframe/rf_netbsdkintf.c |  23 ++++++++++-------------
 1 files changed, 10 insertions(+), 13 deletions(-)

diffs (66 lines):

diff -r fb62f0a95432 -r d73937114f53 sys/dev/raidframe/rf_netbsdkintf.c
--- a/sys/dev/raidframe/rf_netbsdkintf.c        Wed Dec 08 15:23:53 2010 +0000
+++ b/sys/dev/raidframe/rf_netbsdkintf.c        Wed Dec 08 16:18:06 2010 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: rf_netbsdkintf.c,v 1.276 2010/12/04 10:01:16 mrg Exp $ */
+/*     $NetBSD: rf_netbsdkintf.c,v 1.277 2010/12/08 16:18:06 christos Exp $    */
 /*-
  * Copyright (c) 1996, 1997, 1998, 2008 The NetBSD Foundation, Inc.
  * All rights reserved.
@@ -139,7 +139,7 @@
  ***********************************************************/
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: rf_netbsdkintf.c,v 1.276 2010/12/04 10:01:16 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: rf_netbsdkintf.c,v 1.277 2010/12/08 16:18:06 christos Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_compat_netbsd.h"
@@ -1186,7 +1186,7 @@
                 *  there is no stale data left in the case of a
                 *  reconfiguration
                 */
-               memset((char *) raidPtr, 0, sizeof(RF_Raid_t));
+               memset(raidPtr, 0, sizeof(*raidPtr));
                raidPtr->raidid = unit;
 
                retcode = rf_Configure(raidPtr, k_cfg, NULL);
@@ -1252,11 +1252,11 @@
                 */
                RF_Malloc(clabel, sizeof(*clabel), (RF_ComponentLabel_t *));
 
-               retcode = copyin( *clabel_ptr, clabel,
-                                 sizeof(RF_ComponentLabel_t));
+               retcode = copyin(*clabel_ptr, clabel, sizeof(*clabel));
 
                if (retcode) {
-                       return(retcode);
+                       RF_Free(clabel, sizeof(*clabel));
+                       return retcode;
                }
 
                clabel->row = 0; /* Don't allow looking at anything else.*/
@@ -1264,19 +1264,16 @@
                column = clabel->column;
 
                if ((column < 0) || (column >= raidPtr->numCol +
-                                    raidPtr->numSpare)) {
-                       return(EINVAL);
+                   raidPtr->numSpare)) {
+                       RF_Free(clabel, sizeof(*clabel));
+                       return EINVAL;
                }
 
                RF_Free(clabel, sizeof(*clabel));
 
                clabel = raidget_component_label(raidPtr, column);
 
-               if (retcode == 0) {
-                       retcode = copyout(clabel, *clabel_ptr,
-                                         sizeof(RF_ComponentLabel_t));
-               }
-               return (retcode);
+               return copyout(clabel, *clabel_ptr, sizeof(**clabel_ptr));
 
 #if 0
        case RAIDFRAME_SET_COMPONENT_LABEL: