add some sizes to free. looked over by deraadt

5 files changed, 28 insertions, 24 deletions

diff --git a/sys/scsi/ch.c b/sys/scsi/ch.c
index 177b3030885..79086cba67a 100644
--- a/sys/scsi/ch.c
+++ b/sys/scsi/ch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ch.c,v 1.50 2015/03/14 03:38:52 jsg Exp $	*/
+/*	$OpenBSD: ch.c,v 1.51 2015/08/23 01:55:39 tedu Exp $	*/
 /*	$NetBSD: ch.c,v 1.26 1997/02/21 22:06:52 thorpej Exp $	*/
 
 /*
@@ -614,7 +614,7 @@ ch_usergetelemstatus(struct ch_softc *sc,
 	if (data != NULL)
 		dma_free(data, size);
 	if (user_data != NULL)
-		free(user_data, M_DEVBUF, 0);
+		free(user_data, M_DEVBUF, udsize);
 	return (error);
 }
 
diff --git a/sys/scsi/mpath.c b/sys/scsi/mpath.c
index 407c8afa749..abc1acf094c 100644
--- a/sys/scsi/mpath.c
+++ b/sys/scsi/mpath.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mpath.c,v 1.40 2015/06/07 19:13:27 krw Exp $ */
+/*	$OpenBSD: mpath.c,v 1.41 2015/08/23 01:55:39 tedu Exp $ */
 
 /*
  * Copyright (c) 2009 David Gwynne <dlg@openbsd.org>
@@ -504,7 +504,7 @@ mpath_path_attach(struct mpath_path *p, u_int g_id, const struct mpath_ops *ops)
 		    M_WAITOK | M_CANFAIL | M_ZERO);
 		if (g == NULL) {
 			if (newdev) {
-				free(d, M_DEVBUF, 0);
+				free(d, M_DEVBUF, sizeof(*d));
 				sc->sc_devs[target] = NULL;
 			}
 
@@ -568,7 +568,7 @@ mpath_path_detach(struct mpath_path *p)
 	mtx_leave(&d->d_mtx);
 
 	if (g != NULL)
-		free(g, M_DEVBUF, 0);
+		free(g, M_DEVBUF, sizeof(*g));
 
 	scsi_xsh_del(&p->p_xsh);
 
diff --git a/sys/scsi/safte.c b/sys/scsi/safte.c
index 56b09d7f570..563a3880bd2 100644
--- a/sys/scsi/safte.c
+++ b/sys/scsi/safte.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: safte.c,v 1.52 2015/06/07 19:13:27 krw Exp $ */
+/*	$OpenBSD: safte.c,v 1.53 2015/08/23 01:55:39 tedu Exp $ */
 
 /*
  * Copyright (c) 2005 David Gwynne <dlg@openbsd.org>
@@ -199,8 +199,9 @@ safte_attach(struct device *parent, struct device *self, void *aux)
 		if (sc->sc_sensortask == NULL) {
 			printf("%s: unable to register update task\n",
 			    DEVNAME(sc));
+			free(sc->sc_sensors, M_DEVBUF,
+			    sc->sc_nsensors * sizeof(struct safte_sensor));
 			sc->sc_nsensors = sc->sc_ntemps = 0;
-			free(sc->sc_sensors, M_DEVBUF, 0);
 		} else {
 			for (i = 0; i < sc->sc_nsensors; i++)
 				sensor_attach(&sc->sc_sensordev,
@@ -246,7 +247,8 @@ safte_detach(struct device *self, int flags)
 		for (i = 0; i < sc->sc_nsensors; i++)
 			sensor_detach(&sc->sc_sensordev,
 			    &sc->sc_sensors[i].se_sensor);
-		free(sc->sc_sensors, M_DEVBUF, 0);
+		free(sc->sc_sensors, M_DEVBUF,
+		    sc->sc_nsensors * sizeof(struct safte_sensor));
 	}
 
 	if (sc->sc_encbuf != NULL)
diff --git a/sys/scsi/scsiconf.c b/sys/scsi/scsiconf.c
index 723a17e7a68..72499d61c30 100644
--- a/sys/scsi/scsiconf.c
+++ b/sys/scsi/scsiconf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: scsiconf.c,v 1.192 2015/06/07 19:13:27 krw Exp $	*/
+/*	$OpenBSD: scsiconf.c,v 1.193 2015/08/23 01:55:39 tedu Exp $	*/
 /*	$NetBSD: scsiconf.c,v 1.57 1996/05/02 01:09:01 neil Exp $	*/
 
 /*
@@ -505,7 +505,7 @@ scsi_detach_lun(struct scsibus_softc *sc, int target, int lun, int flags)
 	/* 3. if its using the openings io allocator, clean it up */
 	if (ISSET(link->flags, SDEV_OWN_IOPL)) {
 		scsi_iopool_destroy(link->pool);
-		free(link->pool, M_DEVBUF, 0);
+		free(link->pool, M_DEVBUF, sizeof(*link->pool));
 	}
 
 	/* 4. free up its state in the adapter */
@@ -516,7 +516,7 @@ scsi_detach_lun(struct scsibus_softc *sc, int target, int lun, int flags)
 	if (link->id != NULL)
 		devid_free(link->id);
 	scsi_remove_link(sc, link);
-	free(link, M_DEVBUF, 0);
+	free(link, M_DEVBUF, sizeof(*link));
 
 	return (0);
 }
@@ -1067,12 +1067,12 @@ free_devid:
 		devid_free(sc_link->id);
 bad:
 	if (ISSET(sc_link->flags, SDEV_OWN_IOPL))
-		free(sc_link->pool, M_DEVBUF, 0);
+		free(sc_link->pool, M_DEVBUF, sizeof(*sc_link->pool));
 
 	if (scsi->adapter_link->adapter->dev_free != NULL)
 		scsi->adapter_link->adapter->dev_free(sc_link);
 free:
-	free(sc_link, M_DEVBUF, 0);
+	free(sc_link, M_DEVBUF, sizeof(*sc_link));
 	return (rslt);
 }
 
@@ -1274,6 +1274,7 @@ scsi_devid_pg80(struct scsi_link *link)
 	struct scsi_vpd_hdr *hdr = NULL;
 	u_int8_t *pg = NULL;
 	char *id;
+	size_t idlen;
 	int pglen, len;
 	int rv;
 
@@ -1297,8 +1298,9 @@ scsi_devid_pg80(struct scsi_link *link)
 	if (rv != 0)
 		goto free;
 
-	id = malloc(sizeof(link->inqdata.vendor) +
-	    sizeof(link->inqdata.product) + len, M_TEMP, M_WAITOK);
+	idlen = sizeof(link->inqdata.vendor) +
+	    sizeof(link->inqdata.product) + len;
+	id = malloc(idlen, M_TEMP, M_WAITOK);
 	memcpy(id, link->inqdata.vendor, sizeof(link->inqdata.vendor));
 	memcpy(id + sizeof(link->inqdata.vendor), link->inqdata.product,
 	    sizeof(link->inqdata.product));
@@ -1309,7 +1311,7 @@ scsi_devid_pg80(struct scsi_link *link)
 	    sizeof(link->inqdata.vendor) + sizeof(link->inqdata.product) + len,
 	    id);
 
-	free(id, M_TEMP, 0);
+	free(id, M_TEMP, idlen);
 
 free:
 	dma_free(pg, pglen);
@@ -1371,5 +1373,5 @@ void
 devid_free(struct devid *d)
 {
 	if (--d->d_refcount == 0)
-		free(d, M_DEVBUF, 0);
+		free(d, M_DEVBUF, sizeof(*d) + d->d_len);
 }
diff --git a/sys/scsi/ses.c b/sys/scsi/ses.c
index e937645bde4..ae52b77092e 100644
--- a/sys/scsi/ses.c
+++ b/sys/scsi/ses.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ses.c,v 1.54 2014/09/14 14:17:26 jsg Exp $ */
+/*	$OpenBSD: ses.c,v 1.55 2015/08/23 01:55:39 tedu Exp $ */
 
 /*
  * Copyright (c) 2005 David Gwynne <dlg@openbsd.org>
@@ -180,7 +180,7 @@ ses_attach(struct device *parent, struct device *self, void *aux)
 				sensor = TAILQ_FIRST(&sc->sc_sensors);
 				TAILQ_REMOVE(&sc->sc_sensors, sensor,
 				    se_entry);
-				free(sensor, M_DEVBUF, 0);
+				free(sensor, M_DEVBUF, sizeof(*sensor));
 			}
 		} else {
 			TAILQ_FOREACH(sensor, &sc->sc_sensors, se_entry)
@@ -197,7 +197,7 @@ ses_attach(struct device *parent, struct device *self, void *aux)
 		while (!TAILQ_EMPTY(&sc->sc_slots)) {
 			slot = TAILQ_FIRST(&sc->sc_slots);
 			TAILQ_REMOVE(&sc->sc_slots, slot, sl_entry);
-			free(slot, M_DEVBUF, 0);
+			free(slot, M_DEVBUF, sizeof(*slot));
 		}
 	}
 #endif
@@ -229,7 +229,7 @@ ses_detach(struct device *self, int flags)
 		while (!TAILQ_EMPTY(&sc->sc_slots)) {
 			slot = TAILQ_FIRST(&sc->sc_slots);
 			TAILQ_REMOVE(&sc->sc_slots, slot, sl_entry);
-			free(slot, M_DEVBUF, 0);
+			free(slot, M_DEVBUF, sizeof(*slot));
 		}
 	}
 #endif
@@ -242,7 +242,7 @@ ses_detach(struct device *self, int flags)
 			sensor = TAILQ_FIRST(&sc->sc_sensors);
 			sensor_detach(&sc->sc_sensordev, &sensor->se_sensor);
 			TAILQ_REMOVE(&sc->sc_sensors, sensor, se_entry);
-			free(sensor, M_DEVBUF, 0);
+			free(sensor, M_DEVBUF, sizeof(*sensor));
 		}
 	}
 
@@ -499,13 +499,13 @@ error:
 	while (!TAILQ_EMPTY(&sc->sc_slots)) {
 		slot = TAILQ_FIRST(&sc->sc_slots);
 		TAILQ_REMOVE(&sc->sc_slots, slot, sl_entry);
-		free(slot, M_DEVBUF, 0);
+		free(slot, M_DEVBUF, sizeof(*slot));
 	}
 #endif
 	while (!TAILQ_EMPTY(&sc->sc_sensors)) {
 		sensor = TAILQ_FIRST(&sc->sc_sensors);
 		TAILQ_REMOVE(&sc->sc_sensors, sensor, se_entry);
-		free(sensor, M_DEVBUF, 0);
+		free(sensor, M_DEVBUF, sizeof(*sensor));
 	}
 	return (1);
 }