upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-08 16:22:46 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

subr_mbpool: Don't free bogus pointer in error paths

Browse source 
An mbpool is allocated with a contiguous array of mbpages.  Freeing an
individual mbpage has never been valid.  Don't do it.

This bug has been present since this code was introduced in r117624 (2003).

Reported by:	Coverity
CID:		1009687
Sponsored by:	EMC / Isilon Storage Division
This commit is contained in:
Conrad Meyer 2016-04-26 23:58:55 +00:00
parent 5a8c498f2e
commit a286650b08
1 changed files with 1 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
sys/kern/subr_mbpool.c
View file

@ -210,16 +210,13 @@ mbp_alloc_page(struct mbpool *p)
pg = &p->pages[p->npages];
error = bus_dmamem_alloc(p->dmat, &pg->va, BUS_DMA_NOWAIT, &pg->map);
if (error != 0) {
free(pg, M_MBPOOL);
if (error != 0)
return;
}
error = bus_dmamap_load(p->dmat, pg->map, pg->va, p->page_size,
mbp_callback, &pg->phy, 0);
if (error != 0) {
bus_dmamem_free(p->dmat, pg->va, pg->map);
free(pg, M_MBPOOL);
return;
}