Fix bug in malloc_uninit():

Releasing items from the mt_zone can not be done by a simple
uma_zfree() call since mt_zone is allocated with the UMA_ZONE_MALLOC
flag. Use uma_zfree_arg instead and supply the slab.

This bug caused panics in low memory situations on unloading kernel
modules containing MALLOC_DEFINE(..) statements.

Submitted by:	ups

1 files changed, 3 insertions, 1 deletions

diff --git a/sys/kern/kern_malloc.c b/sys/kern/kern_malloc.c
index 27c2d19..385d0a7 100644
--- a/sys/kern/kern_malloc.c
+++ b/sys/kern/kern_malloc.c
@@ -622,6 +622,7 @@ malloc_uninit(void *data)
 	struct malloc_type_internal *mtip;
 	struct malloc_type_stats *mtsp;
 	struct malloc_type *mtp, *temp;
+	uma_slab_t slab;
 	long temp_allocs, temp_bytes;
 	int i;
 
@@ -658,7 +659,8 @@ malloc_uninit(void *data)
 		    temp_allocs, temp_bytes);
 	}
 
-	uma_zfree(mt_zone, mtip);
+	slab = vtoslab((vm_offset_t) mtip & (~UMA_SLAB_MASK));
+	uma_zfree_arg(mt_zone, mtip, slab);
 }
 
 struct malloc_type *