diff options
| author | haad <haad@NetBSD.org> | 2009-09-09 22:38:49 +0000 |
|---|---|---|
| committer | haad <haad@NetBSD.org> | 2009-09-09 22:38:49 +0000 |
| commit | 76a0c0e7d2bef3e06d736c337c82971885904148 (patch) | |
| tree | 676fe675dafc813df0ed313394cbb0cf93c4ab93 /sys/dev | |
| parent | d86fd0848ebfad3579b7b0d03132d27ba3972ad6 (diff) | |
Fix bug in kmem_alloc/kmem_free of params string. Params string was
allocated with length DM_MAX_PARAMS_SIZE and released with strlen + 1 size.
Disable KM_NOSLEEP allocation because we do not need them here there is
nothing critical in ioctl part of dm driver.
Bug reported by jak@.
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/dm/dm_dev.c | 6 | ||||
| -rw-r--r-- | sys/dev/dm/dm_ioctl.c | 6 | ||||
| -rw-r--r-- | sys/dev/dm/dm_pdev.c | 4 | ||||
| -rw-r--r-- | sys/dev/dm/dm_target.c | 4 | ||||
| -rw-r--r-- | sys/dev/dm/dm_target_linear.c | 6 | ||||
| -rw-r--r-- | sys/dev/dm/dm_target_stripe.c | 8 |
6 files changed, 16 insertions, 18 deletions
diff --git a/sys/dev/dm/dm_dev.c b/sys/dev/dm/dm_dev.c index 3c8d20721b9..6392d086b49 100644 --- a/sys/dev/dm/dm_dev.c +++ b/sys/dev/dm/dm_dev.c @@ -1,4 +1,4 @@ -/* $NetBSD: dm_dev.c,v 1.5 2009/04/13 18:51:54 haad Exp $ */ +/* $NetBSD: dm_dev.c,v 1.6 2009/09/09 22:38:49 haad Exp $ */ /* * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -304,10 +304,10 @@ dm_dev_alloc(void) { dm_dev_t *dmv; - dmv = kmem_zalloc(sizeof(dm_dev_t), KM_NOSLEEP); + dmv = kmem_zalloc(sizeof(dm_dev_t), KM_SLEEP); if(dmv != NULL) - dmv->diskp = kmem_zalloc(sizeof(struct disk), KM_NOSLEEP); + dmv->diskp = kmem_zalloc(sizeof(struct disk), KM_SLEEP); return dmv; } diff --git a/sys/dev/dm/dm_ioctl.c b/sys/dev/dm/dm_ioctl.c index b762671f4b2..b925d0aec57 100644 --- a/sys/dev/dm/dm_ioctl.c +++ b/sys/dev/dm/dm_ioctl.c @@ -1,4 +1,4 @@ -/* $NetBSD: dm_ioctl.c,v 1.13 2009/06/05 21:52:31 haad Exp $ */ +/* $NetBSD: dm_ioctl.c,v 1.14 2009/09/09 22:38:49 haad Exp $ */ /* * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -746,7 +746,7 @@ dm_table_load_ioctl(prop_dictionary_t dm_dict) } if ((table_en = kmem_alloc(sizeof(dm_table_entry_t), - KM_NOSLEEP)) == NULL) { + KM_SLEEP)) == NULL) { dm_table_release(&dmv->table_head, DM_TABLE_INACTIVE); dm_dev_unbusy(dmv); return ENOMEM; @@ -913,7 +913,7 @@ dm_table_status_ioctl(prop_dictionary_t dm_dict) prop_dictionary_set_cstring(target_dict, DM_TABLE_PARAMS, params); - kmem_free(params, strlen(params) + 1); + kmem_free(params, DM_MAX_PARAMS_SIZE); } } diff --git a/sys/dev/dm/dm_pdev.c b/sys/dev/dm/dm_pdev.c index 8af4aaaddf9..25ea46ffab7 100644 --- a/sys/dev/dm/dm_pdev.c +++ b/sys/dev/dm/dm_pdev.c @@ -1,4 +1,4 @@ -/* $NetBSD: dm_pdev.c,v 1.3 2009/03/18 10:22:39 cegger Exp $ */ +/* $NetBSD: dm_pdev.c,v 1.4 2009/09/09 22:38:49 haad Exp $ */ /* * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -141,7 +141,7 @@ dm_pdev_alloc(const char *name) { dm_pdev_t *dmp; - if ((dmp = kmem_zalloc(sizeof(dm_pdev_t), KM_NOSLEEP)) == NULL) + if ((dmp = kmem_zalloc(sizeof(dm_pdev_t), KM_SLEEP)) == NULL) return NULL; strlcpy(dmp->name, name, MAX_DEV_NAME); diff --git a/sys/dev/dm/dm_target.c b/sys/dev/dm/dm_target.c index 0b506168b42..9ab0bceb95c 100644 --- a/sys/dev/dm/dm_target.c +++ b/sys/dev/dm/dm_target.c @@ -1,4 +1,4 @@ -/* $NetBSD: dm_target.c,v 1.10 2009/08/16 11:02:40 yamt Exp $ */ +/* $NetBSD: dm_target.c,v 1.11 2009/09/09 22:38:49 haad Exp $ */ /* * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -238,7 +238,7 @@ dm_target_destroy(void) dm_target_t* dm_target_alloc(const char *name) { - return kmem_zalloc(sizeof(dm_target_t), KM_NOSLEEP); + return kmem_zalloc(sizeof(dm_target_t), KM_SLEEP); } /* diff --git a/sys/dev/dm/dm_target_linear.c b/sys/dev/dm/dm_target_linear.c index 33bf191e67e..fb59c9332e5 100644 --- a/sys/dev/dm/dm_target_linear.c +++ b/sys/dev/dm/dm_target_linear.c @@ -1,4 +1,4 @@ -/* $NetBSD: dm_target_linear.c,v 1.6 2009/08/16 11:02:24 yamt Exp $ */ +/* $NetBSD: dm_target_linear.c,v 1.7 2009/09/09 22:38:49 haad Exp $ */ /* * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -78,7 +78,7 @@ dm_target_linear_init(dm_dev_t *dmv, void **target_config, prop_dictionary_t dic aprint_debug("Linear target init function called %s--%"PRIu64"!!\n", device, offset); - if ((tlc = kmem_alloc(sizeof(dm_target_linear_config_t), KM_NOSLEEP)) + if ((tlc = kmem_alloc(sizeof(dm_target_linear_config_t), KM_SLEEP)) == NULL) return 1; @@ -109,7 +109,7 @@ dm_target_linear_status(void *target_config) aprint_debug("Linear target status function called\n"); - if ((params = kmem_alloc(DM_MAX_PARAMS_SIZE, KM_NOSLEEP)) == NULL) + if ((params = kmem_alloc(DM_MAX_PARAMS_SIZE, KM_SLEEP)) == NULL) return NULL; aprint_normal("%s %"PRIu64, tlc->pdev->name, tlc->offset); diff --git a/sys/dev/dm/dm_target_stripe.c b/sys/dev/dm/dm_target_stripe.c index e44df8b2b7a..64cdbeadf04 100644 --- a/sys/dev/dm/dm_target_stripe.c +++ b/sys/dev/dm/dm_target_stripe.c @@ -1,4 +1,4 @@ -/*$NetBSD: dm_target_stripe.c,v 1.6 2009/06/05 19:56:40 haad Exp $*/ +/*$NetBSD: dm_target_stripe.c,v 1.7 2009/09/09 22:38:49 haad Exp $*/ /* * Copyright (c) 2009 The NetBSD Foundation, Inc. @@ -164,8 +164,6 @@ dm_target_stripe_init(dm_dev_t *dmv, void **target_config, prop_dictionary_t dic tsc->stripe_devs[0].offset = offset1; tsc->stripe_devs[1].offset = offset2; - /* Save length of param string */ - tsc->params_len = DM_MAX_PARAMS_SIZE; tsc->stripe_chunksize = chunk_size; tsc->stripe_num = (uint8_t)stripes; @@ -185,10 +183,10 @@ dm_target_stripe_status(void *target_config) tsc = target_config; - if ((params = kmem_alloc(tsc->params_len, KM_NOSLEEP)) == NULL) + if ((params = kmem_alloc(DM_MAX_PARAMS_SIZE, KM_SLEEP)) == NULL) return NULL; - snprintf(params, tsc->params_len, "%d %"PRIu64" %s %"PRIu64" %s %"PRIu64, + snprintf(params, DM_MAX_PARAMS_SIZE, "%d %"PRIu64" %s %"PRIu64" %s %"PRIu64, tsc->stripe_num, tsc->stripe_chunksize, tsc->stripe_devs[0].pdev->name, tsc->stripe_devs[0].offset, tsc->stripe_devs[1].pdev->name, tsc->stripe_devs[1].offset); |
