CVS commit: [netbsd-6-1] src/sys/dev/usb

[SAITOH Masanobu]

Module Name:    src
Committed By:   msaitoh
Date:           Thu Aug  7 08:05:24 UTC 2014

Modified Files:
        src/sys/dev/usb [netbsd-6-1]: if_urndis.c

Log Message:
Pull up following revision(s) (requested by skrll in ticket #1094):
        sys/dev/usb/if_urndis.c: revision 1.7
PR/48963: kmem_free size mismatch causes panic when attaching urndis(4).
Fix the size passed in kmem_free in the urndis_ctrl_{query,set} functions


To generate a diff of this commit:
cvs rdiff -u -r1.3.2.1 -r1.3.2.1.2.1 src/sys/dev/usb/if_urndis.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/usb/if_urndis.c
diff -u src/sys/dev/usb/if_urndis.c:1.3.2.1 src/sys/dev/usb/if_urndis.c:1.3.2.1.2.1
--- src/sys/dev/usb/if_urndis.c:1.3.2.1	Sat Nov 24 04:01:21 2012
+++ src/sys/dev/usb/if_urndis.c	Thu Aug  7 08:05:24 2014
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_urndis.c,v 1.3.2.1 2012/11/24 04:01:21 riz Exp $ */
+/*	$NetBSD: if_urndis.c,v 1.3.2.1.2.1 2014/08/07 08:05:24 msaitoh Exp $ */
 /*	$OpenBSD: if_urndis.c,v 1.31 2011/07/03 15:47:17 matthew Exp $ */
 
 /*
@@ -21,7 +21,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_urndis.c,v 1.3.2.1 2012/11/24 04:01:21 riz Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_urndis.c,v 1.3.2.1.2.1 2014/08/07 08:05:24 msaitoh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -513,7 +513,7 @@ urndis_ctrl_query(struct urndis_softc *s
 	    le32toh(msg->rm_devicevchdl)));
 
 	rval = urndis_ctrl_send(sc, msg, sizeof(*msg));
-	kmem_free(msg, sizeof(*msg));
+	kmem_free(msg, sizeof(*msg) + qlen);
 
 	if (rval != RNDIS_STATUS_SUCCESS) {
 		printf("%s: query failed\n", DEVNAME(sc));
@@ -566,7 +566,7 @@ urndis_ctrl_set(struct urndis_softc *sc,
 	    le32toh(msg->rm_devicevchdl)));
 
 	rval = urndis_ctrl_send(sc, msg, sizeof(*msg));
-	kmem_free(msg, sizeof(*msg));
+	kmem_free(msg, sizeof(*msg) + len);
 
 	if (rval != RNDIS_STATUS_SUCCESS) {
 		printf("%s: set failed\n", DEVNAME(sc));