struct malloc_type has had a 'magic' field statically initialized to

M_MAGIC by MALLOC_DEFINE() for a long time; add assertions that
malloc_type's passed to malloc(), free(), etc have that magic set.

MFC after:	2 weeks

1 files changed, 13 insertions, 1 deletions

diff --git a/sys/kern/kern_malloc.c b/sys/kern/kern_malloc.c
index 8c627a1..7bb5a81 100644
--- a/sys/kern/kern_malloc.c
+++ b/sys/kern/kern_malloc.c
@@ -1,7 +1,7 @@
 /*-
  * Copyright (c) 1987, 1991, 1993
  *	The Regents of the University of California.
- * Copyright (c) 2005-2006 Robert N. M. Watson
+ * Copyright (c) 2005-2009 Robert N. M. Watson
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -334,6 +334,7 @@ malloc(unsigned long size, struct malloc_type *mtp, int flags)
 #endif
 
 #ifdef INVARIANTS
+	KASSERT(mtp->ks_magic == M_MAGIC, ("malloc: bad malloc type magic"));
 	/*
 	 * Check that exactly one of M_WAITOK or M_NOWAIT is specified.
 	 */
@@ -419,6 +420,8 @@ free(void *addr, struct malloc_type *mtp)
 	uma_slab_t slab;
 	u_long size;
 
+	KASSERT(mtp->ks_magic == M_MAGIC, ("free: bad malloc type magic"));
+
 	/* free(NULL, ...) does nothing */
 	if (addr == NULL)
 		return;
@@ -480,6 +483,9 @@ realloc(void *addr, unsigned long size, struct malloc_type *mtp, int flags)
 	unsigned long alloc;
 	void *newaddr;
 
+	KASSERT(mtp->ks_magic == M_MAGIC,
+	    ("realloc: bad malloc type magic"));
+
 	/* realloc(NULL, ...) is equivalent to malloc(...) */
 	if (addr == NULL)
 		return (malloc(size, mtp, flags));
@@ -673,6 +679,9 @@ malloc_init(void *data)
 	KASSERT(cnt.v_page_count != 0, ("malloc_register before vm_init"));
 
 	mtp = data;
+	KASSERT(mtp->ks_magic == M_MAGIC,
+	    ("malloc_init: bad malloc type magic"));
+
 	mtip = uma_zalloc(mt_zone, M_WAITOK | M_ZERO);
 	mtp->ks_handle = mtip;
 
@@ -694,7 +703,10 @@ malloc_uninit(void *data)
 	int i;
 
 	mtp = data;
+	KASSERT(mtp->ks_magic == M_MAGIC,
+	    ("malloc_uninit: bad malloc type magic"));
 	KASSERT(mtp->ks_handle != NULL, ("malloc_deregister: cookie NULL"));
+
 	mtx_lock(&malloc_mtx);
 	mtip = mtp->ks_handle;
 	mtp->ks_handle = NULL;