Pass the sizes of the interrupt and isochronous arrays to free(9). While here convert a malloc(9) to mallocarray(9).
Untested for lack of hardware. ok? Index: uhci.c =================================================================== RCS file: /cvs/src/sys/dev/usb/uhci.c,v retrieving revision 1.143 diff -u -p -r1.143 uhci.c --- uhci.c 15 May 2017 10:52:08 -0000 1.143 +++ uhci.c 14 Nov 2018 17:32:35 -0000 @@ -1924,10 +1924,12 @@ uhci_device_intr_close(struct usbd_pipe { struct uhci_pipe *upipe = (struct uhci_pipe *)pipe; struct uhci_softc *sc = (struct uhci_softc *)pipe->device->bus; + struct uhci_soft_qh **qhs; int i, npoll; int s; /* Unlink descriptors from controller data structures. */ + qhs = upipe->u.intr.qhs; npoll = upipe->u.intr.npoll; s = splusb(); for (i = 0; i < npoll; i++) @@ -1942,7 +1944,7 @@ uhci_device_intr_close(struct usbd_pipe for(i = 0; i < npoll; i++) uhci_free_sqh(sc, upipe->u.intr.qhs[i]); - free(upipe->u.intr.qhs, M_USBHC, 0); + free(qhs, M_USBHC, npoll * sizeof(*qhs)); /* XXX free other resources */ } @@ -2302,7 +2304,7 @@ uhci_device_isoc_close(struct usbd_pipe } splx(s); - free(iso->stds, M_USBHC, 0); + free(iso->stds, M_USBHC, UHCI_VFRAMELIST_COUNT * sizeof(*iso->stds)); } usbd_status @@ -2319,9 +2321,8 @@ uhci_setup_isoc(struct usbd_pipe *pipe) int i, s; iso = &upipe->u.iso; - iso->stds = malloc(UHCI_VFRAMELIST_COUNT * - sizeof (struct uhci_soft_td *), - M_USBHC, M_WAITOK); + iso->stds = mallocarray(UHCI_VFRAMELIST_COUNT, sizeof(*iso->stds), + M_USBHC, M_WAITOK); token = rd ? UHCI_TD_IN (0, endpt, addr, 0) : UHCI_TD_OUT(0, endpt, addr, 0); @@ -2356,7 +2357,7 @@ uhci_setup_isoc(struct usbd_pipe *pipe) bad: while (--i >= 0) uhci_free_std(sc, iso->stds[i]); - free(iso->stds, M_USBHC, 0); + free(iso->stds, M_USBHC, UHCI_VFRAMELIST_COUNT * sizeof(*iso->stds)); return (USBD_NOMEM); } @@ -2557,8 +2558,7 @@ uhci_device_setintr(struct uhci_softc *s npoll = (UHCI_VFRAMELIST_COUNT + ival - 1) / ival; DPRINTFN(2, ("uhci_device_setintr: ival=%d npoll=%d\n", ival, npoll)); - qhs = mallocarray(npoll, sizeof(struct uhci_soft_qh *), M_USBHC, - M_NOWAIT); + qhs = mallocarray(npoll, sizeof(*qhs), M_USBHC, M_NOWAIT); if (qhs == NULL) return (USBD_NOMEM); @@ -2582,7 +2582,7 @@ uhci_device_setintr(struct uhci_softc *s if (sqh == NULL) { while (i > 0) uhci_free_sqh(sc, qhs[--i]); - free(qhs, M_USBHC, 0); + free(qhs, M_USBHC, npoll * sizeof(*qhs)); return (USBD_NOMEM); } sqh->elink = NULL;