Skip site navigation (1)Skip section navigation (2) 
Date:      Fri, 11 Oct 2013 21:30:27 +0000 (UTC)
From:      Peter Grehan <grehan@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r256350 - in head/sys/dev/hyperv: include vmbus
Message-ID:  <201310112130.r9BLURGs027643@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: grehan
Date: Fri Oct 11 21:30:27 2013
New Revision: 256350
URL: http://svnweb.freebsd.org/changeset/base/256350

Log:
  Fix vmbus channel memory leak where incorrect length parameter was
  being passed to contigfree().
  
  Submitted by:	Microsoft hyperv dev team
  Approved by:	re@ (glebius)

Modified:
  head/sys/dev/hyperv/include/hyperv.h
  head/sys/dev/hyperv/vmbus/hv_channel.c

Modified: head/sys/dev/hyperv/include/hyperv.h
==============================================================================
--- head/sys/dev/hyperv/include/hyperv.h	Fri Oct 11 21:24:33 2013	(r256349)
+++ head/sys/dev/hyperv/include/hyperv.h	Fri Oct 11 21:30:27 2013	(r256350)
@@ -24,6 +24,8 @@
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
  */
 
 /**
@@ -669,6 +671,7 @@ typedef struct hv_vmbus_channel {
 	 * Allocated memory for ring buffer
 	 */
 	void*				ring_buffer_pages;
+	unsigned long			ring_buffer_size;
 	uint32_t			ring_buffer_page_count;
 	/*
 	 * send to parent

Modified: head/sys/dev/hyperv/vmbus/hv_channel.c
==============================================================================
--- head/sys/dev/hyperv/vmbus/hv_channel.c	Fri Oct 11 21:24:33 2013	(r256349)
+++ head/sys/dev/hyperv/vmbus/hv_channel.c	Fri Oct 11 21:30:27 2013	(r256350)
@@ -104,17 +104,19 @@ hv_vmbus_channel_open(
 
 	/* Allocate the ring buffer */
 	out = contigmalloc((send_ring_buffer_size + recv_ring_buffer_size),
-		M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0);
+	    M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0);
 	KASSERT(out != NULL,
 	    ("Error VMBUS: contigmalloc failed to allocate Ring Buffer!"));
 	if (out == NULL)
-	    return (ENOMEM);
+		return (ENOMEM);
 
 	in = ((uint8_t *) out + send_ring_buffer_size);
 
 	new_channel->ring_buffer_pages = out;
-	new_channel->ring_buffer_page_count = (send_ring_buffer_size
-		+ recv_ring_buffer_size) >> PAGE_SHIFT;
+	new_channel->ring_buffer_page_count = (send_ring_buffer_size +
+	    recv_ring_buffer_size) >> PAGE_SHIFT;
+	new_channel->ring_buffer_size = send_ring_buffer_size +
+	    recv_ring_buffer_size;
 
 	hv_vmbus_ring_buffer_init(
 		&new_channel->outbound,
@@ -539,10 +541,8 @@ hv_vmbus_channel_close(hv_vmbus_channel 
 	hv_ring_buffer_cleanup(&channel->outbound);
 	hv_ring_buffer_cleanup(&channel->inbound);
 
-	contigfree(
-		channel->ring_buffer_pages,
-		channel->ring_buffer_page_count,
-		M_DEVBUF);
+	contigfree(channel->ring_buffer_pages, channel->ring_buffer_size,
+	    M_DEVBUF);
 
 	free(info, M_DEVBUF);

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201310112130.r9BLURGs027643>