From owner-svn-src-stable@FreeBSD.ORG Fri Oct 11 21:47:18 2013 Return-Path: Delivered-To: svn-src-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 39859D18; Fri, 11 Oct 2013 21:47:18 +0000 (UTC) (envelope-from grehan@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 0AF5D265B; Fri, 11 Oct 2013 21:47:18 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9BLlH6Q035284; Fri, 11 Oct 2013 21:47:17 GMT (envelope-from grehan@svn.freebsd.org) Received: (from grehan@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9BLlHjW035282; Fri, 11 Oct 2013 21:47:17 GMT (envelope-from grehan@svn.freebsd.org) Message-Id: <201310112147.r9BLlHjW035282@svn.freebsd.org> From: Peter Grehan Date: Fri, 11 Oct 2013 21:47:17 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r256352 - in stable/10/sys/dev/hyperv: include vmbus X-SVN-Group: stable-10 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Oct 2013 21:47:18 -0000 Author: grehan Date: Fri Oct 11 21:47:17 2013 New Revision: 256352 URL: http://svnweb.freebsd.org/changeset/base/256352 Log: MFC r256350 Fix vmbus channel memory leak where incorrect length parameter was being passed to contigfree(). Approved by: re@ (glebius) Modified: stable/10/sys/dev/hyperv/include/hyperv.h stable/10/sys/dev/hyperv/vmbus/hv_channel.c Directory Properties: stable/10/sys/ (props changed) stable/10/sys/dev/hyperv/ (props changed) Modified: stable/10/sys/dev/hyperv/include/hyperv.h ============================================================================== --- stable/10/sys/dev/hyperv/include/hyperv.h Fri Oct 11 21:41:07 2013 (r256351) +++ stable/10/sys/dev/hyperv/include/hyperv.h Fri Oct 11 21:47:17 2013 (r256352) @@ -24,6 +24,8 @@ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ */ /** @@ -669,6 +671,7 @@ typedef struct hv_vmbus_channel { * Allocated memory for ring buffer */ void* ring_buffer_pages; + unsigned long ring_buffer_size; uint32_t ring_buffer_page_count; /* * send to parent Modified: stable/10/sys/dev/hyperv/vmbus/hv_channel.c ============================================================================== --- stable/10/sys/dev/hyperv/vmbus/hv_channel.c Fri Oct 11 21:41:07 2013 (r256351) +++ stable/10/sys/dev/hyperv/vmbus/hv_channel.c Fri Oct 11 21:47:17 2013 (r256352) @@ -104,17 +104,19 @@ hv_vmbus_channel_open( /* Allocate the ring buffer */ out = contigmalloc((send_ring_buffer_size + recv_ring_buffer_size), - M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0); + M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0); KASSERT(out != NULL, ("Error VMBUS: contigmalloc failed to allocate Ring Buffer!")); if (out == NULL) - return (ENOMEM); + return (ENOMEM); in = ((uint8_t *) out + send_ring_buffer_size); new_channel->ring_buffer_pages = out; - new_channel->ring_buffer_page_count = (send_ring_buffer_size - + recv_ring_buffer_size) >> PAGE_SHIFT; + new_channel->ring_buffer_page_count = (send_ring_buffer_size + + recv_ring_buffer_size) >> PAGE_SHIFT; + new_channel->ring_buffer_size = send_ring_buffer_size + + recv_ring_buffer_size; hv_vmbus_ring_buffer_init( &new_channel->outbound, @@ -539,10 +541,8 @@ hv_vmbus_channel_close(hv_vmbus_channel hv_ring_buffer_cleanup(&channel->outbound); hv_ring_buffer_cleanup(&channel->inbound); - contigfree( - channel->ring_buffer_pages, - channel->ring_buffer_page_count, - M_DEVBUF); + contigfree(channel->ring_buffer_pages, channel->ring_buffer_size, + M_DEVBUF); free(info, M_DEVBUF);