Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 11 Oct 2013 21:47:17 +0000 (UTC)
From:      Peter Grehan <grehan@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r256352 - in stable/10/sys/dev/hyperv: include vmbus
Message-ID:  <201310112147.r9BLlHjW035282@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: grehan
Date: Fri Oct 11 21:47:17 2013
New Revision: 256352
URL: http://svnweb.freebsd.org/changeset/base/256352

Log:
  MFC r256350
  
    Fix vmbus channel memory leak where incorrect length parameter was
    being passed to contigfree().
  
  Approved by:	re@ (glebius)

Modified:
  stable/10/sys/dev/hyperv/include/hyperv.h
  stable/10/sys/dev/hyperv/vmbus/hv_channel.c
Directory Properties:
  stable/10/sys/   (props changed)
  stable/10/sys/dev/hyperv/   (props changed)

Modified: stable/10/sys/dev/hyperv/include/hyperv.h
==============================================================================
--- stable/10/sys/dev/hyperv/include/hyperv.h	Fri Oct 11 21:41:07 2013	(r256351)
+++ stable/10/sys/dev/hyperv/include/hyperv.h	Fri Oct 11 21:47:17 2013	(r256352)
@@ -24,6 +24,8 @@
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
  */
 
 /**
@@ -669,6 +671,7 @@ typedef struct hv_vmbus_channel {
 	 * Allocated memory for ring buffer
 	 */
 	void*				ring_buffer_pages;
+	unsigned long			ring_buffer_size;
 	uint32_t			ring_buffer_page_count;
 	/*
 	 * send to parent

Modified: stable/10/sys/dev/hyperv/vmbus/hv_channel.c
==============================================================================
--- stable/10/sys/dev/hyperv/vmbus/hv_channel.c	Fri Oct 11 21:41:07 2013	(r256351)
+++ stable/10/sys/dev/hyperv/vmbus/hv_channel.c	Fri Oct 11 21:47:17 2013	(r256352)
@@ -104,17 +104,19 @@ hv_vmbus_channel_open(
 
 	/* Allocate the ring buffer */
 	out = contigmalloc((send_ring_buffer_size + recv_ring_buffer_size),
-		M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0);
+	    M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0);
 	KASSERT(out != NULL,
 	    ("Error VMBUS: contigmalloc failed to allocate Ring Buffer!"));
 	if (out == NULL)
-	    return (ENOMEM);
+		return (ENOMEM);
 
 	in = ((uint8_t *) out + send_ring_buffer_size);
 
 	new_channel->ring_buffer_pages = out;
-	new_channel->ring_buffer_page_count = (send_ring_buffer_size
-		+ recv_ring_buffer_size) >> PAGE_SHIFT;
+	new_channel->ring_buffer_page_count = (send_ring_buffer_size +
+	    recv_ring_buffer_size) >> PAGE_SHIFT;
+	new_channel->ring_buffer_size = send_ring_buffer_size +
+	    recv_ring_buffer_size;
 
 	hv_vmbus_ring_buffer_init(
 		&new_channel->outbound,
@@ -539,10 +541,8 @@ hv_vmbus_channel_close(hv_vmbus_channel 
 	hv_ring_buffer_cleanup(&channel->outbound);
 	hv_ring_buffer_cleanup(&channel->inbound);
 
-	contigfree(
-		channel->ring_buffer_pages,
-		channel->ring_buffer_page_count,
-		M_DEVBUF);
+	contigfree(channel->ring_buffer_pages, channel->ring_buffer_size,
+	    M_DEVBUF);
 
 	free(info, M_DEVBUF);

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201310112147.r9BLlHjW035282>