From owner-svn-src-head@FreeBSD.ORG Fri Oct 11 21:30:28 2013 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 62A44879; Fri, 11 Oct 2013 21:30:28 +0000 (UTC) (envelope-from grehan@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 35B812569; Fri, 11 Oct 2013 21:30:28 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9BLUSOB027646; Fri, 11 Oct 2013 21:30:28 GMT (envelope-from grehan@svn.freebsd.org) Received: (from grehan@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9BLURGs027643; Fri, 11 Oct 2013 21:30:27 GMT (envelope-from grehan@svn.freebsd.org) Message-Id: <201310112130.r9BLURGs027643@svn.freebsd.org> From: Peter Grehan Date: Fri, 11 Oct 2013 21:30:27 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r256350 - in head/sys/dev/hyperv: include vmbus X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Oct 2013 21:30:28 -0000 Author: grehan Date: Fri Oct 11 21:30:27 2013 New Revision: 256350 URL: http://svnweb.freebsd.org/changeset/base/256350 Log: Fix vmbus channel memory leak where incorrect length parameter was being passed to contigfree(). Submitted by: Microsoft hyperv dev team Approved by: re@ (glebius) Modified: head/sys/dev/hyperv/include/hyperv.h head/sys/dev/hyperv/vmbus/hv_channel.c Modified: head/sys/dev/hyperv/include/hyperv.h ============================================================================== --- head/sys/dev/hyperv/include/hyperv.h Fri Oct 11 21:24:33 2013 (r256349) +++ head/sys/dev/hyperv/include/hyperv.h Fri Oct 11 21:30:27 2013 (r256350) @@ -24,6 +24,8 @@ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ */ /** @@ -669,6 +671,7 @@ typedef struct hv_vmbus_channel { * Allocated memory for ring buffer */ void* ring_buffer_pages; + unsigned long ring_buffer_size; uint32_t ring_buffer_page_count; /* * send to parent Modified: head/sys/dev/hyperv/vmbus/hv_channel.c ============================================================================== --- head/sys/dev/hyperv/vmbus/hv_channel.c Fri Oct 11 21:24:33 2013 (r256349) +++ head/sys/dev/hyperv/vmbus/hv_channel.c Fri Oct 11 21:30:27 2013 (r256350) @@ -104,17 +104,19 @@ hv_vmbus_channel_open( /* Allocate the ring buffer */ out = contigmalloc((send_ring_buffer_size + recv_ring_buffer_size), - M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0); + M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0); KASSERT(out != NULL, ("Error VMBUS: contigmalloc failed to allocate Ring Buffer!")); if (out == NULL) - return (ENOMEM); + return (ENOMEM); in = ((uint8_t *) out + send_ring_buffer_size); new_channel->ring_buffer_pages = out; - new_channel->ring_buffer_page_count = (send_ring_buffer_size - + recv_ring_buffer_size) >> PAGE_SHIFT; + new_channel->ring_buffer_page_count = (send_ring_buffer_size + + recv_ring_buffer_size) >> PAGE_SHIFT; + new_channel->ring_buffer_size = send_ring_buffer_size + + recv_ring_buffer_size; hv_vmbus_ring_buffer_init( &new_channel->outbound, @@ -539,10 +541,8 @@ hv_vmbus_channel_close(hv_vmbus_channel hv_ring_buffer_cleanup(&channel->outbound); hv_ring_buffer_cleanup(&channel->inbound); - contigfree( - channel->ring_buffer_pages, - channel->ring_buffer_page_count, - M_DEVBUF); + contigfree(channel->ring_buffer_pages, channel->ring_buffer_size, + M_DEVBUF); free(info, M_DEVBUF);