diff options
| author | grehan <grehan@FreeBSD.org> | 2013-10-11 21:47:17 +0000 |
|---|---|---|
| committer | grehan <grehan@FreeBSD.org> | 2013-10-11 21:47:17 +0000 |
| commit | f6c283672e887f04524b02fb957fbfd53a349f6e (patch) | |
| tree | 88611d53f8125e51d568126a4c73f63f733fd3ea /sys/dev | |
| parent | c0fff0b71f3c6ec27c933546137391bfb374feeb (diff) | |
| download | FreeBSD-src-f6c283672e887f04524b02fb957fbfd53a349f6e.zip FreeBSD-src-f6c283672e887f04524b02fb957fbfd53a349f6e.tar.gz | |
MFC r256350
Fix vmbus channel memory leak where incorrect length parameter was
being passed to contigfree().
Approved by: re@ (glebius)
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/hyperv/include/hyperv.h | 3 | ||||
| -rw-r--r-- | sys/dev/hyperv/vmbus/hv_channel.c | 16 |
2 files changed, 11 insertions, 8 deletions
diff --git a/sys/dev/hyperv/include/hyperv.h b/sys/dev/hyperv/include/hyperv.h index 3651269..4257b37 100644 --- a/sys/dev/hyperv/include/hyperv.h +++ b/sys/dev/hyperv/include/hyperv.h @@ -24,6 +24,8 @@ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ */ /** @@ -669,6 +671,7 @@ typedef struct hv_vmbus_channel { * Allocated memory for ring buffer */ void* ring_buffer_pages; + unsigned long ring_buffer_size; uint32_t ring_buffer_page_count; /* * send to parent diff --git a/sys/dev/hyperv/vmbus/hv_channel.c b/sys/dev/hyperv/vmbus/hv_channel.c index c467c22..103260a 100644 --- a/sys/dev/hyperv/vmbus/hv_channel.c +++ b/sys/dev/hyperv/vmbus/hv_channel.c @@ -104,17 +104,19 @@ hv_vmbus_channel_open( /* Allocate the ring buffer */ out = contigmalloc((send_ring_buffer_size + recv_ring_buffer_size), - M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0); + M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0); KASSERT(out != NULL, ("Error VMBUS: contigmalloc failed to allocate Ring Buffer!")); if (out == NULL) - return (ENOMEM); + return (ENOMEM); in = ((uint8_t *) out + send_ring_buffer_size); new_channel->ring_buffer_pages = out; - new_channel->ring_buffer_page_count = (send_ring_buffer_size - + recv_ring_buffer_size) >> PAGE_SHIFT; + new_channel->ring_buffer_page_count = (send_ring_buffer_size + + recv_ring_buffer_size) >> PAGE_SHIFT; + new_channel->ring_buffer_size = send_ring_buffer_size + + recv_ring_buffer_size; hv_vmbus_ring_buffer_init( &new_channel->outbound, @@ -539,10 +541,8 @@ hv_vmbus_channel_close(hv_vmbus_channel *channel) hv_ring_buffer_cleanup(&channel->outbound); hv_ring_buffer_cleanup(&channel->inbound); - contigfree( - channel->ring_buffer_pages, - channel->ring_buffer_page_count, - M_DEVBUF); + contigfree(channel->ring_buffer_pages, channel->ring_buffer_size, + M_DEVBUF); free(info, M_DEVBUF); |
