diff options
| author | cem <cem@FreeBSD.org> | 2016-04-26 23:58:55 +0000 |
|---|---|---|
| committer | cem <cem@FreeBSD.org> | 2016-04-26 23:58:55 +0000 |
| commit | 1e1ff456ba8494363cb350d3b56683c0a3ca313e (patch) | |
| tree | b3b29dbac9e3e0aac725cd22d44da2b947d45acd /sys/kern | |
| parent | b435e07ac0d05e254fb43af54dd93bb2202a8edc (diff) | |
| download | FreeBSD-src-1e1ff456ba8494363cb350d3b56683c0a3ca313e.zip FreeBSD-src-1e1ff456ba8494363cb350d3b56683c0a3ca313e.tar.gz | |
subr_mbpool: Don't free bogus pointer in error paths
An mbpool is allocated with a contiguous array of mbpages. Freeing an
individual mbpage has never been valid. Don't do it.
This bug has been present since this code was introduced in r117624 (2003).
Reported by: Coverity
CID: 1009687
Sponsored by: EMC / Isilon Storage Division
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/subr_mbpool.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/sys/kern/subr_mbpool.c b/sys/kern/subr_mbpool.c index bf52d85..0b44dcc 100644 --- a/sys/kern/subr_mbpool.c +++ b/sys/kern/subr_mbpool.c @@ -210,16 +210,13 @@ mbp_alloc_page(struct mbpool *p) pg = &p->pages[p->npages]; error = bus_dmamem_alloc(p->dmat, &pg->va, BUS_DMA_NOWAIT, &pg->map); - if (error != 0) { - free(pg, M_MBPOOL); + if (error != 0) return; - } error = bus_dmamap_load(p->dmat, pg->map, pg->va, p->page_size, mbp_callback, &pg->phy, 0); if (error != 0) { bus_dmamem_free(p->dmat, pg->va, pg->map); - free(pg, M_MBPOOL); return; } |
