Hello - The following diff adds free sizes to free() calls in uvm/. Only one remaining in uvm/.
Index: uvm/uvm_amap.c =================================================================== RCS file: /cvs/src/sys/uvm/uvm_amap.c,v retrieving revision 1.78 diff -u -p -r1.78 uvm_amap.c --- uvm/uvm_amap.c 8 Oct 2016 16:19:44 -0000 1.78 +++ uvm/uvm_amap.c 30 Jan 2017 21:17:22 -0000 @@ -368,7 +368,7 @@ amap_alloc1(int slots, int waitf, int la return(amap); fail1: - free(amap->am_buckets, M_UVMAMAP, 0); + free(amap->am_buckets, M_UVMAMAP, buckets * sizeof(*amap->am_buckets)); TAILQ_FOREACH_SAFE(chunk, &amap->am_chunks, ac_list, tmp) pool_put(&uvm_amap_chunk_pool, chunk); pool_put(&uvm_amap_pool, amap); @@ -414,7 +414,7 @@ amap_free(struct vm_amap *amap) #ifdef UVM_AMAP_PPREF if (amap->am_ppref && amap->am_ppref != PPREF_NONE) - free(amap->am_ppref, M_UVMAMAP, 0); + free(amap->am_ppref, M_UVMAMAP, amap->am_nslot * sizeof(int)); #endif if (UVM_AMAP_SMALL(amap)) Index: uvm/uvm_aobj.c =================================================================== RCS file: /cvs/src/sys/uvm/uvm_aobj.c,v retrieving revision 1.84 diff -u -p -r1.84 uvm_aobj.c --- uvm/uvm_aobj.c 24 Sep 2016 18:40:29 -0000 1.84 +++ uvm/uvm_aobj.c 30 Jan 2017 21:17:22 -0000 @@ -403,7 +403,7 @@ uao_free(struct uvm_aobj *aobj) uvmexp.swpgonly--; } } - free(aobj->u_swslots, M_UVMAOBJ, 0); + free(aobj->u_swslots, M_UVMAOBJ, aobj->u_pages * sizeof(int)); } /* finally free the aobj itself */ @@ -532,7 +532,7 @@ uao_shrink_array(struct uvm_object *uobj for (i = 0; i < pages; i++) new_swslots[i] = aobj->u_swslots[i]; - free(aobj->u_swslots, M_UVMAOBJ, 0); + free(aobj->u_swslots, M_UVMAOBJ, aobj->u_pages * sizeof(int)); aobj->u_swslots = new_swslots; aobj->u_pages = pages; @@ -585,7 +585,7 @@ uao_grow_array(struct uvm_object *uobj, for (i = 0; i < aobj->u_pages; i++) new_swslots[i] = aobj->u_swslots[i]; - free(aobj->u_swslots, M_UVMAOBJ, 0); + free(aobj->u_swslots, M_UVMAOBJ, aobj->u_pages * sizeof(int)); aobj->u_swslots = new_swslots; aobj->u_pages = pages; @@ -664,7 +664,7 @@ uao_grow_convert(struct uvm_object *uobj } } - free(old_swslots, M_UVMAOBJ, 0); + free(old_swslots, M_UVMAOBJ, aobj->u_pages * sizeof(int)); aobj->u_pages = pages; return 0;