- Check if the ccb_infos in the softc is NULL before trying to free it in

  adv_free() as the ISA probe routine doesn't malloc() ccb_infos but does
  call adv_free().
- Release the ISA-only overrun DMA tags, bufs, and maps if the probe fails.

Tested by:	rwatson

2 files changed, 11 insertions, 2 deletions

diff --git a/sys/dev/advansys/adv_isa.c b/sys/dev/advansys/adv_isa.c
index f423629..f55dcc7 100644
--- a/sys/dev/advansys/adv_isa.c
+++ b/sys/dev/advansys/adv_isa.c
@@ -237,7 +237,7 @@ adv_isa_probe(device_t dev)
 			return ENXIO; 
 		}
 
-		adv->init_level++;
+		adv->init_level += 2;
 
 		if (overrun_buf == NULL) {
 			/* Need to allocate our overrun buffer */
@@ -278,6 +278,10 @@ adv_isa_probe(device_t dev)
 		adv->overrun_physbase = overrun_physbase;
 
 		if (adv_init(adv) != 0) {
+			bus_dmamap_unload(overrun_dmat, overrun_dmamap);
+			bus_dmamem_free(overrun_dmat, overrun_buf,
+			    overrun_dmamap);
+			bus_dma_tag_destroy(overrun_dmat);
 			adv_free(adv);
 			bus_release_resource(dev, SYS_RES_IOPORT, 0, iores);
 			return ENXIO;
@@ -317,6 +321,10 @@ adv_isa_probe(device_t dev)
 		if (irqres == NULL ||
 		    bus_setup_intr(dev, irqres, INTR_TYPE_CAM, adv_intr, adv,
 				   &ih)) {
+			bus_dmamap_unload(overrun_dmat, overrun_dmamap);
+			bus_dmamem_free(overrun_dmat, overrun_buf,
+			    overrun_dmamap);
+			bus_dma_tag_destroy(overrun_dmat);
 			adv_free(adv);
 			bus_release_resource(dev, SYS_RES_IOPORT, 0, iores);
 			return ENXIO;
diff --git a/sys/dev/advansys/advansys.c b/sys/dev/advansys/advansys.c
index 6391efc..40287e9 100644
--- a/sys/dev/advansys/advansys.c
+++ b/sys/dev/advansys/advansys.c
@@ -768,7 +768,8 @@ adv_free(struct adv_softc *adv)
 	case 2:
 		bus_dma_tag_destroy(adv->parent_dmat);
 	case 1:
-		free(adv->ccb_infos, M_DEVBUF);
+		if (adv->ccb_infos != NULL)
+			free(adv->ccb_infos, M_DEVBUF);
 	case 0:
 		break;
 	}