diff options
author | grehan <grehan@FreeBSD.org> | 2013-10-11 21:30:27 +0000 |
---|---|---|
committer | grehan <grehan@FreeBSD.org> | 2013-10-11 21:30:27 +0000 |
commit | 35b7675f726443ac3856400e0cf111b9dfc30e93 (patch) | |
tree | 34d20c12e0858b4b43bbd940df4b973b720ea946 /sys/dev | |
parent | b1f224fcfd1ec94903c8a95f75ca05285454f185 (diff) | |
download | FreeBSD-src-35b7675f726443ac3856400e0cf111b9dfc30e93.zip FreeBSD-src-35b7675f726443ac3856400e0cf111b9dfc30e93.tar.gz |
Fix vmbus channel memory leak where incorrect length parameter was
being passed to contigfree().
Submitted by: Microsoft hyperv dev team
Approved by: re@ (glebius)
Diffstat (limited to 'sys/dev')
-rw-r--r-- | sys/dev/hyperv/include/hyperv.h | 3 | ||||
-rw-r--r-- | sys/dev/hyperv/vmbus/hv_channel.c | 16 |
2 files changed, 11 insertions, 8 deletions
diff --git a/sys/dev/hyperv/include/hyperv.h b/sys/dev/hyperv/include/hyperv.h index 3651269..4257b37 100644 --- a/sys/dev/hyperv/include/hyperv.h +++ b/sys/dev/hyperv/include/hyperv.h @@ -24,6 +24,8 @@ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ */ /** @@ -669,6 +671,7 @@ typedef struct hv_vmbus_channel { * Allocated memory for ring buffer */ void* ring_buffer_pages; + unsigned long ring_buffer_size; uint32_t ring_buffer_page_count; /* * send to parent diff --git a/sys/dev/hyperv/vmbus/hv_channel.c b/sys/dev/hyperv/vmbus/hv_channel.c index c467c22..103260a 100644 --- a/sys/dev/hyperv/vmbus/hv_channel.c +++ b/sys/dev/hyperv/vmbus/hv_channel.c @@ -104,17 +104,19 @@ hv_vmbus_channel_open( /* Allocate the ring buffer */ out = contigmalloc((send_ring_buffer_size + recv_ring_buffer_size), - M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0); + M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0); KASSERT(out != NULL, ("Error VMBUS: contigmalloc failed to allocate Ring Buffer!")); if (out == NULL) - return (ENOMEM); + return (ENOMEM); in = ((uint8_t *) out + send_ring_buffer_size); new_channel->ring_buffer_pages = out; - new_channel->ring_buffer_page_count = (send_ring_buffer_size - + recv_ring_buffer_size) >> PAGE_SHIFT; + new_channel->ring_buffer_page_count = (send_ring_buffer_size + + recv_ring_buffer_size) >> PAGE_SHIFT; + new_channel->ring_buffer_size = send_ring_buffer_size + + recv_ring_buffer_size; hv_vmbus_ring_buffer_init( &new_channel->outbound, @@ -539,10 +541,8 @@ hv_vmbus_channel_close(hv_vmbus_channel *channel) hv_ring_buffer_cleanup(&channel->outbound); hv_ring_buffer_cleanup(&channel->inbound); - contigfree( - channel->ring_buffer_pages, - channel->ring_buffer_page_count, - M_DEVBUF); + contigfree(channel->ring_buffer_pages, channel->ring_buffer_size, + M_DEVBUF); free(info, M_DEVBUF); |