mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-27 11:55:06 +00:00
Code Issues Releases Activity

subr_mbpool: Don't free bogus pointer in error paths

Browse Source 
An mbpool is allocated with a contiguous array of mbpages.  Freeing an
individual mbpage has never been valid.  Don't do it.

This bug has been present since this code was introduced in r117624 (2003).

Reported by:	Coverity
CID:		1009687
Sponsored by:	EMC / Isilon Storage Division
This commit is contained in:
Conrad Meyer 2016-04-26 23:58:55 +00:00
parent 5a8c498f2e
commit a286650b08
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=298677
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/kern/subr_mbpool.c
View File

@ -210,16 +210,13 @@ mbp_alloc_page(struct mbpool *p)
pg = &p->pages[p->npages];
error = bus_dmamem_alloc(p->dmat, &pg->va, BUS_DMA_NOWAIT, &pg->map);
if (error != 0) {
free(pg, M_MBPOOL);
if (error != 0)
return;
}
error = bus_dmamap_load(p->dmat, pg->map, pg->va, p->page_size,
mbp_callback, &pg->phy, 0);
if (error != 0) {
bus_dmamem_free(p->dmat, pg->va, pg->map);
free(pg, M_MBPOOL);
return;
}