Browse files

MFC r256350

  Fix vmbus channel memory leak where incorrect length parameter was
  being passed to contigfree().

Approved by:	re@ (glebius)
  • Loading branch information...
1 parent c0fff0b commit f6c283672e887f04524b02fb957fbfd53a349f6e @grehan-freebsd grehan-freebsd committed Oct 11, 2013
Showing with 11 additions and 8 deletions.
  1. +3 −0 sys/dev/hyperv/include/hyperv.h
  2. +8 −8 sys/dev/hyperv/vmbus/hv_channel.c
View
3 sys/dev/hyperv/include/hyperv.h
@@ -24,6 +24,8 @@
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
*/
/**
@@ -669,6 +671,7 @@ typedef struct hv_vmbus_channel {
* Allocated memory for ring buffer
*/
void* ring_buffer_pages;
+ unsigned long ring_buffer_size;
uint32_t ring_buffer_page_count;
/*
* send to parent
View
16 sys/dev/hyperv/vmbus/hv_channel.c
@@ -104,17 +104,19 @@ hv_vmbus_channel_open(
/* Allocate the ring buffer */
out = contigmalloc((send_ring_buffer_size + recv_ring_buffer_size),
- M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0);
+ M_DEVBUF, M_ZERO, 0UL, BUS_SPACE_MAXADDR, PAGE_SIZE, 0);
KASSERT(out != NULL,
("Error VMBUS: contigmalloc failed to allocate Ring Buffer!"));
if (out == NULL)
- return (ENOMEM);
+ return (ENOMEM);
in = ((uint8_t *) out + send_ring_buffer_size);
new_channel->ring_buffer_pages = out;
- new_channel->ring_buffer_page_count = (send_ring_buffer_size
- + recv_ring_buffer_size) >> PAGE_SHIFT;
+ new_channel->ring_buffer_page_count = (send_ring_buffer_size +
+ recv_ring_buffer_size) >> PAGE_SHIFT;
+ new_channel->ring_buffer_size = send_ring_buffer_size +
+ recv_ring_buffer_size;
hv_vmbus_ring_buffer_init(
&new_channel->outbound,
@@ -539,10 +541,8 @@ hv_vmbus_channel_close(hv_vmbus_channel *channel)
hv_ring_buffer_cleanup(&channel->outbound);
hv_ring_buffer_cleanup(&channel->inbound);
- contigfree(
- channel->ring_buffer_pages,
- channel->ring_buffer_page_count,
- M_DEVBUF);
+ contigfree(channel->ring_buffer_pages, channel->ring_buffer_size,
+ M_DEVBUF);
free(info, M_DEVBUF);

0 comments on commit f6c2836

Please sign in to comment.