Note ahc_set_name() gets invoked with the dv_xname field of a struct
device, so it's not a good idea to free anything, should it be invoked
more than once.

Tested on:
ahc0 at pci0 dev 1 function 0 "Adaptec AIC-7880" rev 0x00: irq 8
ahc0: Host Adapter Bios disabled.  Using default SCSI device parameters
scsibus0 at ahc0: 16 targets, initiator 7
sd0 at scsibus0 targ 1 lun 0: <SGI, IBM DNES-318350Y, SAF0> SCSI3 0/direct 
fixed serial.SGI_IBM_DNES-318350Y_AK0T7943
sd0: 17364MB, 512 bytes/sector, 35563040 sectors
cd0 at scsibus0 targ 4 lun 0: <TOSHIBA, CD-ROM XM-6401TA, 1015> SCSI2 5/cdrom 
removable
ahc1 at pci0 dev 2 function 0 "Adaptec AIC-7880" rev 0x00: irq 9
ahc1: Host Adapter Bios disabled.  Using default SCSI device parameters
scsibus1 at ahc1: 16 targets, initiator 7

Index: dev/ic/aic7xxx.c
===================================================================
RCS file: /OpenBSD/src/sys/dev/ic/aic7xxx.c,v
retrieving revision 1.93
diff -u -p -u -p -r1.93 aic7xxx.c
--- dev/ic/aic7xxx.c    12 Dec 2017 12:33:36 -0000      1.93
+++ dev/ic/aic7xxx.c    14 May 2019 10:28:10 -0000
@@ -1688,7 +1688,7 @@ ahc_free_tstate(struct ahc_softc *ahc, u
                scsi_id += 8;
        tstate = ahc->enabled_targets[scsi_id];
        if (tstate != NULL)
-               free(tstate, M_DEVBUF, 0);
+               free(tstate, M_DEVBUF, sizeof(*tstate));
        ahc->enabled_targets[scsi_id] = NULL;
 }
 #endif
@@ -3957,8 +3957,6 @@ ahc_set_unit(struct ahc_softc *ahc, int 
 void
 ahc_set_name(struct ahc_softc *ahc, char *name)
 {
-       if (ahc->name != NULL)
-               free(ahc->name, M_DEVBUF, 0);
        ahc->name = name;
 }
 
@@ -3997,21 +3995,21 @@ ahc_free(struct ahc_softc *ahc)
                                lstate = tstate->enabled_luns[j];
                                if (lstate != NULL) {
                                          /*xpt_free_path(lstate->path);*/
-                                       free(lstate, M_DEVBUF, 0);
+                                       free(lstate, M_DEVBUF, sizeof(*lstate));
                                }
                        }
 #endif
-                       free(tstate, M_DEVBUF, 0);
+                       free(tstate, M_DEVBUF, sizeof(*tstate));
                }
        }
 #ifdef AHC_TARGET_MODE
        if (ahc->black_hole != NULL) {
          /*xpt_free_path(ahc->black_hole->path);*/
-               free(ahc->black_hole, M_DEVBUF, 0);
+               free(ahc->black_hole, M_DEVBUF, sizeof(*ahc->black_hole));
        }
 #endif
        if (ahc->seep_config != NULL)
-               free(ahc->seep_config, M_DEVBUF, 0);
+               free(ahc->seep_config, M_DEVBUF, sizeof(*ahc->seep_config));
        return;
 }
 
@@ -4329,7 +4327,7 @@ ahc_fini_scbdata(struct ahc_softc *ahc)
                        ahc_freedmamem(ahc->parent_dmat, PAGE_SIZE,
                            sg_map->sg_dmamap, (caddr_t)sg_map->sg_vaddr,
                            &sg_map->sg_dmasegs, sg_map->sg_nseg);
-                       free(sg_map, M_DEVBUF, 0);
+                       free(sg_map, M_DEVBUF, sizeof(*sg_map));
                }
        }
        /*FALLTHROUGH*/
@@ -4350,8 +4348,10 @@ ahc_fini_scbdata(struct ahc_softc *ahc)
        case 0:
                break;
        }
-       if (scb_data->scbarray != NULL)
-               free(scb_data->scbarray, M_DEVBUF, 0);
+       if (scb_data->scbarray != NULL) {
+               free(scb_data->scbarray, M_DEVBUF,
+                   AHC_SCB_MAX_ALLOC * sizeof(struct scb));
+       }
 }
 
 void
@@ -4383,7 +4383,7 @@ ahc_alloc_scbs(struct ahc_softc *ahc)
                             (caddr_t *)&sg_map->sg_vaddr, &sg_map->sg_physaddr,
                             &sg_map->sg_dmasegs, &sg_map->sg_nseg, 
ahc_name(ahc),
                             "SG space") < 0) {
-               free(sg_map, M_DEVBUF, 0);
+               free(sg_map, M_DEVBUF, sizeof(*sg_map));
                return;
        }
 
@@ -6859,7 +6859,7 @@ ahc_handle_en_lun(struct ahc_softc *ahc,
                                         xpt_path_target_id(ccb->ccb_h.path),
                                         xpt_path_lun_id(ccb->ccb_h.path));
                if (status != CAM_REQ_CMP) {
-                       free(lstate, M_DEVBUF, 0);
+                       free(lstate, M_DEVBUF, sizeof(*lstate));
                        xpt_print_path(ccb->ccb_h.path);
                        printf("Couldn't allocate path\n");
                        ccb->ccb_h.status = CAM_RESRC_UNAVAIL;
@@ -6980,7 +6980,7 @@ ahc_handle_en_lun(struct ahc_softc *ahc,
                xpt_print_path(ccb->ccb_h.path);
                printf("Target mode disabled\n");
                xpt_free_path(lstate->path);
-               free(lstate, M_DEVBUF, 0);
+               free(lstate, M_DEVBUF, sizeof(*lstate));
 
                ahc_pause(ahc);
                /* Can we clean up the target too? */
Index: dev/ic/aic7xxx_seeprom.c
===================================================================
RCS file: /OpenBSD/src/sys/dev/ic/aic7xxx_seeprom.c,v
retrieving revision 1.7
diff -u -p -u -p -r1.7 aic7xxx_seeprom.c
--- dev/ic/aic7xxx_seeprom.c    17 Jul 2015 21:42:49 -0000      1.7
+++ dev/ic/aic7xxx_seeprom.c    14 May 2019 10:28:10 -0000
@@ -195,7 +195,7 @@ ahc_check_extport(struct ahc_softc *ahc,
                if (bootverbose)
                        printf("%s: No SEEPROM available.\n", ahc_name(ahc));
                ahc->flags |= AHC_USEDEFAULTS | AHC_NO_BIOS_INIT;
-               free(ahc->seep_config, M_DEVBUF, 0);
+               free(ahc->seep_config, M_DEVBUF, sizeof(*ahc->seep_config));
                ahc->seep_config = NULL;
                sc = NULL;
        } else {

Reply via email to