From owner-svn-src-all@FreeBSD.ORG Sun Oct 16 17:09:58 2011 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 767D5106566B; Sun, 16 Oct 2011 17:09:58 +0000 (UTC) (envelope-from SRS0=Y50X=47=FreeBSD.org=brueffer@srs.kundenserver.de) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.187]) by mx1.freebsd.org (Postfix) with ESMTP id 06E048FC14; Sun, 16 Oct 2011 17:09:57 +0000 (UTC) Received: from hd5b90bea.sedadby.dyn.perspektivbredband.net (hd5b90bea.sedadby.dyn.perspektivbredband.net [213.185.11.234]) by mrelayeu.kundenserver.de (node=mreu4) with ESMTP (Nemesis) id 0Mccy4-1RX9Or03DE-00Hgdn; Sun, 16 Oct 2011 18:57:21 +0200 Message-ID: <4E9B0CEE.7000809@FreeBSD.org> Date: Sun, 16 Oct 2011 18:57:18 +0200 From: Christian Brueffer User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:7.0.1) Gecko/20110929 Thunderbird/7.0.1 MIME-Version: 1.0 To: Pawel Jakub Dawidek References: <201110151557.p9FFvuuc020536@svn.freebsd.org> <20111016154611.GA1832@garage.freebsd.pl> In-Reply-To: <20111016154611.GA1832@garage.freebsd.pl> Content-Type: multipart/mixed; boundary="------------040404080201060701070605" X-Provags-ID: V02:K0:6QiO0+ryfkYjRi0WOAvzaXFrvr2kRVFsvjPvoB9TVkE GURb9ARhgH9dqEV7d1pC8/LWKAUCX8MzO6yqXRY+4PAQZLQwpr eBb7as/rgZqzhxogE3MBcXS7DGn+IeOjHaMbjomQdEGrUtBcF9 vC17TScHAA+m3sKOGp3keVbdPgptCJ3Dp0wa06NYFtEKom01v/ 7bY9/vlNRNz2brQsxDug4BNXpLo1ZV/jnci07msLML/ZW+y8LU zYxVWZVoz/RarJWohZyBB1006P6liPD4C/vlxCAxldySmNkoX/ 4xjvAEHfY0FHFQ2iwND1FmBKnAj8aRx70IF2KfNmFyAFDE3/Td dnCNh9DE0XV2V4Y3PnEGsqjAtNE80SMnuWn1fYd0shduTanF0d OPAEohwkg0znGJzuF518ri+N/G3z9TqV8A= Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org Subject: Re: svn commit: r226398 - head/sys/dev/iicbus X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Oct 2011 17:09:58 -0000 This is a multi-part message in MIME format. --------------040404080201060701070605 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit On 10/16/11 17:46 , Pawel Jakub Dawidek wrote: > On Sat, Oct 15, 2011 at 03:57:56PM +0000, Christian Brueffer wrote: >> Author: brueffer >> Date: Sat Oct 15 15:57:55 2011 >> New Revision: 226398 >> URL: http://svn.freebsd.org/changeset/base/226398 >> >> Log: >> Properly free resources in an error case. >> >> CID: 4203 >> Found with: Coverity Prevent(tm) >> MFC after: 1 week >> >> Modified: >> head/sys/dev/iicbus/iic.c >> >> Modified: head/sys/dev/iicbus/iic.c >> ============================================================================== >> --- head/sys/dev/iicbus/iic.c Sat Oct 15 15:21:33 2011 (r226397) >> +++ head/sys/dev/iicbus/iic.c Sat Oct 15 15:57:55 2011 (r226398) >> @@ -348,8 +348,10 @@ iicioctl(struct cdev *dev, u_long cmd, c >> buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_TEMP, M_WAITOK); >> usrbufs = malloc(sizeof(void *) * d->nmsgs, M_TEMP, M_ZERO | M_WAITOK); >> error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs); >> - if (error) >> + if (error) { >> + free(usrbufs, M_TEMP); >> break; >> + } > > I think that better fix is to move usrbufs allocation after copyin(), as > usrbufs is not used there. > Agreed, how about the attached patch? --------------040404080201060701070605 Content-Type: text/plain; x-mac-type="0"; x-mac-creator="0"; name="iic.c.diff" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="iic.c.diff" Index: iic.c =================================================================== --- iic.c (revision 226398) +++ iic.c (working copy) @@ -346,13 +346,11 @@ case I2CRDWR: buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_TEMP, M_WAITOK); - usrbufs = malloc(sizeof(void *) * d->nmsgs, M_TEMP, M_ZERO | M_WAITOK); error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs); - if (error) { - free(usrbufs, M_TEMP); + if (error) break; - } /* Alloc kernel buffers for userland data, copyin write data */ + usrbufs = malloc(sizeof(void *) * d->nmsgs, M_TEMP, M_ZERO | M_WAITOK); for (i = 0; i < d->nmsgs; i++) { m = &((struct iic_msg *)buf)[i]; usrbufs[i] = m->buf; --------------040404080201060701070605--