Module Name: src
Committed By: palle
Date: Fri Mar 3 21:09:25 UTC 2017
Modified Files:
src/sys/arch/sparc64/dev: ldc.c vdsk.c
Log Message:
sun4v: Fixed PR 51554 - Avoid unsafe allocation in ldc/vdsk
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 src/sys/arch/sparc64/dev/ldc.c \
src/sys/arch/sparc64/dev/vdsk.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/sparc64/dev/ldc.c
diff -u src/sys/arch/sparc64/dev/ldc.c:1.2 src/sys/arch/sparc64/dev/ldc.c:1.3
--- src/sys/arch/sparc64/dev/ldc.c:1.2 Sat Aug 20 18:21:18 2016
+++ src/sys/arch/sparc64/dev/ldc.c Fri Mar 3 21:09:25 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: ldc.c,v 1.2 2016/08/20 18:21:18 nakayama Exp $ */
+/* $NetBSD: ldc.c,v 1.3 2017/03/03 21:09:25 palle Exp $ */
/* $OpenBSD: ldc.c,v 1.12 2015/03/21 18:02:58 kettenis Exp $ */
/*
* Copyright (c) 2009 Mark Kettenis
@@ -554,6 +554,8 @@ ldc_queue_alloc(int nentries)
goto unmap;
#else
va = (vaddr_t)kmem_zalloc(size, KM_NOSLEEP);
+ if (va == 0)
+ goto free;
#endif
lq->lq_va = (vaddr_t)va;
lq->lq_nentries = nentries;
@@ -565,6 +567,9 @@ free:
bus_dmamem_free(t, &lq->lq_seg, 1);
destroy:
bus_dmamap_destroy(t, lq->lq_map);
+#else
+free:
+ kmem_free(lq, sizeof(struct ldc_queue));
#endif
return (NULL);
}
@@ -637,6 +642,8 @@ ldc_map_alloc(int nentries)
}
#else
va = (vaddr_t)kmem_zalloc(size, KM_NOSLEEP);
+ if (va == 0)
+ goto free;
#endif
lm->lm_slot = (struct ldc_map_slot *)va;
lm->lm_nentries = nentries;
@@ -650,6 +657,9 @@ free:
bus_dmamem_free(t, &lm->lm_seg, 1);
destroy:
bus_dmamap_destroy(t, lm->lm_map);
+#else
+free:
+ kmem_free(lm, sizeof(struct ldc_map));
#endif
return (NULL);
}
Index: src/sys/arch/sparc64/dev/vdsk.c
diff -u src/sys/arch/sparc64/dev/vdsk.c:1.2 src/sys/arch/sparc64/dev/vdsk.c:1.3
--- src/sys/arch/sparc64/dev/vdsk.c:1.2 Sat Aug 20 18:21:18 2016
+++ src/sys/arch/sparc64/dev/vdsk.c Fri Mar 3 21:09:25 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: vdsk.c,v 1.2 2016/08/20 18:21:18 nakayama Exp $ */
+/* $NetBSD: vdsk.c,v 1.3 2017/03/03 21:09:25 palle Exp $ */
/* $OpenBSD: vdsk.c,v 1.46 2015/01/25 21:42:13 kettenis Exp $ */
/*
* Copyright (c) 2009, 2011 Mark Kettenis
@@ -969,6 +969,8 @@ vdsk_dring_alloc(int nentries)
goto unmap;
#else
va = (vaddr_t)kmem_zalloc(size, KM_NOSLEEP);
+ if (va == 0)
+ goto free;
#endif
vd->vd_desc = (struct vd_desc *)va;
vd->vd_nentries = nentries;
@@ -984,6 +986,9 @@ free:
bus_dmamem_free(t, &vd->vd_seg, 1);
destroy:
bus_dmamap_destroy(t, vd->vd_map);
+#else
+free:
+ kmem_free(vd, sizeof(struct vdsk_dring));
#endif
return (NULL);
}
