sizes for free(), mostly related to firmwares.

ok dlg

6 files changed, 34 insertions, 28 deletions

diff --git a/sys/dev/pci/if_em.c b/sys/dev/pci/if_em.c
index dace553b0dd..5c2d4351d67 100644
--- a/sys/dev/pci/if_em.c
+++ b/sys/dev/pci/if_em.c
@@ -31,7 +31,7 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ***************************************************************************/
 
-/* $OpenBSD: if_em.c,v 1.301 2015/08/26 09:17:20 kettenis Exp $ */
+/* $OpenBSD: if_em.c,v 1.302 2015/09/01 07:09:55 deraadt Exp $ */
 /* $FreeBSD: if_em.c,v 1.46 2004/09/29 18:28:28 mlaier Exp $ */
 
 #include <dev/pci/if_em.h>
@@ -2308,7 +2308,8 @@ em_free_transmit_structures(struct em_softc *sc)
 		}
 	}
 	if (sc->tx_buffer_area != NULL) {
-		free(sc->tx_buffer_area, M_DEVBUF, 0);
+		free(sc->tx_buffer_area, M_DEVBUF,
+		    sc->num_tx_desc * sizeof(struct em_buffer));
 		sc->tx_buffer_area = NULL;
 	}
 	if (sc->txtag != NULL)
@@ -2768,7 +2769,8 @@ em_free_receive_structures(struct em_softc *sc)
 		}
 	}
 	if (sc->rx_buffer_area != NULL) {
-		free(sc->rx_buffer_area, M_DEVBUF, 0);
+		free(sc->rx_buffer_area, M_DEVBUF,
+		    sc->num_tx_desc * sizeof(struct em_buffer));
 		sc->rx_buffer_area = NULL;
 	}
 	if (sc->rxtag != NULL)
diff --git a/sys/dev/pci/if_ipw.c b/sys/dev/pci/if_ipw.c
index 496545b731f..0bdf8ce88bf 100644
--- a/sys/dev/pci/if_ipw.c
+++ b/sys/dev/pci/if_ipw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ipw.c,v 1.108 2015/05/27 22:10:52 kettenis Exp $	*/
+/*	$OpenBSD: if_ipw.c,v 1.109 2015/09/01 07:09:55 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2004-2008
@@ -1632,7 +1632,6 @@ ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
 {
 	const struct ipw_firmware_hdr *hdr;
 	const char *name;
-	size_t size;
 	int error;
 
 	switch (sc->sc_ic.ic_opmode) {
@@ -1651,10 +1650,10 @@ ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
 		/* should not get there */
 		return ENODEV;
 	}
-	if ((error = loadfirmware(name, &fw->data, &size)) != 0)
+	if ((error = loadfirmware(name, &fw->data, &fw->size)) != 0)
 		return error;
 
-	if (size < sizeof (*hdr)) {
+	if (fw->size < sizeof (*hdr)) {
 		error = EINVAL;
 		goto fail;
 	}
@@ -1662,7 +1661,7 @@ ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
 	fw->main_size  = letoh32(hdr->main_size);
 	fw->ucode_size = letoh32(hdr->ucode_size);
 
-	if (size < sizeof (*hdr) + fw->main_size + fw->ucode_size) {
+	if (fw->size < sizeof (*hdr) + fw->main_size + fw->ucode_size) {
 		error = EINVAL;
 		goto fail;
 	}
@@ -1671,7 +1670,7 @@ ipw_read_firmware(struct ipw_softc *sc, struct ipw_firmware *fw)
 
 	return 0;
 
-fail:	free(fw->data, M_DEVBUF, 0);
+fail:	free(fw->data, M_DEVBUF, fw->size);
 	return error;
 }
 
@@ -2012,7 +2011,7 @@ ipw_init(struct ifnet *ifp)
 		goto fail2;
 	}
 	sc->sc_flags |= IPW_FLAG_FW_INITED;
-	free(fw.data, M_DEVBUF, 0);
+	free(fw.data, M_DEVBUF, fw.size);
 	fw.data = NULL;
 
 	/* retrieve information tables base addresses */
@@ -2037,7 +2036,7 @@ ipw_init(struct ifnet *ifp)
 
 	return 0;
 
-fail2:	free(fw.data, M_DEVBUF, 0);
+fail2:	free(fw.data, M_DEVBUF, fw.size);
 	fw.data = NULL;
 fail1:	ipw_stop(ifp, 0);
 	return error;
diff --git a/sys/dev/pci/if_ipwvar.h b/sys/dev/pci/if_ipwvar.h
index 7dbcbd6d161..8d01e4dab89 100644
--- a/sys/dev/pci/if_ipwvar.h
+++ b/sys/dev/pci/if_ipwvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ipwvar.h,v 1.24 2014/12/19 15:19:47 krw Exp $	*/
+/*	$OpenBSD: if_ipwvar.h,v 1.25 2015/09/01 07:09:55 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2004-2006
@@ -19,6 +19,7 @@
 
 struct ipw_firmware {
 	u_char	*data;
+	size_t	size;
 	u_char	*main;
 	size_t	main_size;
 	u_char	*ucode;
diff --git a/sys/dev/pci/if_iwi.c b/sys/dev/pci/if_iwi.c
index 284bd599449..36e5912f044 100644
--- a/sys/dev/pci/if_iwi.c
+++ b/sys/dev/pci/if_iwi.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwi.c,v 1.125 2015/05/27 22:10:52 kettenis Exp $	*/
+/*	$OpenBSD: if_iwi.c,v 1.126 2015/09/01 07:09:55 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2004-2008
@@ -2288,7 +2288,7 @@ iwi_init(struct ifnet *ifp)
 		goto fail2;
 	}
 
-	free(data, M_DEVBUF, 0);
+	free(data, M_DEVBUF, size);
 	sc->sc_flags |= IWI_FLAG_FW_INITED;
 
 	if ((error = iwi_config(sc)) != 0) {
@@ -2307,7 +2307,7 @@ iwi_init(struct ifnet *ifp)
 
 	return 0;
 
-fail2:	free(data, M_DEVBUF, 0);
+fail2:	free(data, M_DEVBUF, size);
 fail1:	iwi_stop(ifp, 0);
 	return error;
 }
diff --git a/sys/dev/pci/if_iwn.c b/sys/dev/pci/if_iwn.c
index 41af1eac0fa..dc5f9487661 100644
--- a/sys/dev/pci/if_iwn.c
+++ b/sys/dev/pci/if_iwn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_iwn.c,v 1.143 2015/05/27 22:10:52 kettenis Exp $	*/
+/*	$OpenBSD: if_iwn.c,v 1.144 2015/09/01 07:09:55 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
@@ -4659,7 +4659,7 @@ iwn_scan(struct iwn_softc *sc, uint16_t flags)
 
 	DPRINTF(("sending scan command nchan=%d\n", hdr->nchan));
 	error = iwn_cmd(sc, IWN_CMD_SCAN, buf, buflen, 1);
-	free(buf, M_DEVBUF, 0);
+	free(buf, M_DEVBUF, IWN_SCAN_MAXSZ);
 	return error;
 }
 
@@ -5730,7 +5730,7 @@ iwn_read_firmware(struct iwn_softc *sc)
 	if (fw->size < sizeof (uint32_t)) {
 		printf("%s: firmware too short: %zu bytes\n",
 		    sc->sc_dev.dv_xname, fw->size);
-		free(fw->data, M_DEVBUF, 0);
+		free(fw->data, M_DEVBUF, fw->size);
 		return EINVAL;
 	}
 
@@ -5742,7 +5742,7 @@ iwn_read_firmware(struct iwn_softc *sc)
 	if (error != 0) {
 		printf("%s: could not read firmware sections\n",
 		    sc->sc_dev.dv_xname);
-		free(fw->data, M_DEVBUF, 0);
+		free(fw->data, M_DEVBUF, fw->size);
 		return error;
 	}
 
@@ -5755,7 +5755,7 @@ iwn_read_firmware(struct iwn_softc *sc)
 	    (fw->boot.textsz & 3) != 0) {
 		printf("%s: firmware sections too large\n",
 		    sc->sc_dev.dv_xname);
-		free(fw->data, M_DEVBUF, 0);
+		free(fw->data, M_DEVBUF, fw->size);
 		return EINVAL;
 	}
 
@@ -6158,7 +6158,7 @@ iwn_init(struct ifnet *ifp)
 
 	/* Initialize hardware and upload firmware. */
 	error = iwn_hw_init(sc);
-	free(sc->fw.data, M_DEVBUF, 0);
+	free(sc->fw.data, M_DEVBUF, sc->fw.size);
 	if (error != 0) {
 		printf("%s: could not initialize hardware\n",
 		    sc->sc_dev.dv_xname);
diff --git a/sys/dev/pci/if_ix.c b/sys/dev/pci/if_ix.c
index bb53228ad3c..95877a92a63 100644
--- a/sys/dev/pci/if_ix.c
+++ b/sys/dev/pci/if_ix.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ix.c,v 1.122 2015/08/29 17:40:09 kettenis Exp $	*/
+/*	$OpenBSD: if_ix.c,v 1.123 2015/09/01 07:09:55 deraadt Exp $	*/
 
 /******************************************************************************
 
@@ -303,7 +303,8 @@ err_late:
 	ixgbe_free_receive_structures(sc);
 err_out:
 	ixgbe_free_pci_resources(sc);
-	free(sc->mta, M_DEVBUF, 0);
+	free(sc->mta, M_DEVBUF, IXGBE_ETH_LENGTH_OF_ADDRESS *
+	    MAX_NUM_MULTICAST_ADDRESSES);
 }
 
 /*********************************************************************
@@ -341,7 +342,8 @@ ixgbe_detach(struct device *self, int flags)
 
 	ixgbe_free_transmit_structures(sc);
 	ixgbe_free_receive_structures(sc);
-	free(sc->mta, M_DEVBUF, 0);
+	free(sc->mta, M_DEVBUF, IXGBE_ETH_LENGTH_OF_ADDRESS *
+	    MAX_NUM_MULTICAST_ADDRESSES);
 
 	return (0);
 }
@@ -1793,10 +1795,10 @@ err_rx_desc:
 err_tx_desc:
 	for (txr = sc->tx_rings; txconf > 0; txr++, txconf--)
 		ixgbe_dma_free(sc, &txr->txdma);
-	free(sc->rx_rings, M_DEVBUF, 0);
+	free(sc->rx_rings, M_DEVBUF, sc->num_queues * sizeof(struct rx_ring));
 	sc->rx_rings = NULL;
 rx_fail:
-	free(sc->tx_rings, M_DEVBUF, 0);
+	free(sc->tx_rings, M_DEVBUF, sc->num_queues * sizeof(struct tx_ring));
 	sc->tx_rings = NULL;
 fail:
 	return (ENOMEM);
@@ -2030,7 +2032,8 @@ ixgbe_free_transmit_buffers(struct tx_ring *txr)
 	}
 
 	if (txr->tx_buffers != NULL)
-		free(txr->tx_buffers, M_DEVBUF, 0);
+		free(txr->tx_buffers, M_DEVBUF,
+		    sc->num_queues * sizeof(struct tx_ring));
 	txr->tx_buffers = NULL;
 	txr->txtag = NULL;
 }
@@ -2791,7 +2794,8 @@ ixgbe_free_receive_buffers(struct rx_ring *rxr)
 			bus_dmamap_destroy(rxr->rxdma.dma_tag, rxbuf->map);
 			rxbuf->map = NULL;
 		}
-		free(rxr->rx_buffers, M_DEVBUF, 0);
+		free(rxr->rx_buffers, M_DEVBUF,
+		    sc->num_queues * sizeof(struct rx_ring));
 		rxr->rx_buffers = NULL;
 	}
 }