From 76a0c0e7d2bef3e06d736c337c82971885904148 Mon Sep 17 00:00:00 2001 From: haad Date: Wed, 9 Sep 2009 22:38:49 +0000 Subject: Fix bug in kmem_alloc/kmem_free of params string. Params string was allocated with length DM_MAX_PARAMS_SIZE and released with strlen + 1 size. Disable KM_NOSLEEP allocation because we do not need them here there is nothing critical in ioctl part of dm driver. Bug reported by jak@. --- sys/dev/dm/dm_ioctl.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'sys/dev/dm/dm_ioctl.c') diff --git a/sys/dev/dm/dm_ioctl.c b/sys/dev/dm/dm_ioctl.c index b762671f4b2..b925d0aec57 100644 --- a/sys/dev/dm/dm_ioctl.c +++ b/sys/dev/dm/dm_ioctl.c @@ -1,4 +1,4 @@ -/* $NetBSD: dm_ioctl.c,v 1.13 2009/06/05 21:52:31 haad Exp $ */ +/* $NetBSD: dm_ioctl.c,v 1.14 2009/09/09 22:38:49 haad Exp $ */ /* * Copyright (c) 2008 The NetBSD Foundation, Inc. @@ -746,7 +746,7 @@ dm_table_load_ioctl(prop_dictionary_t dm_dict) } if ((table_en = kmem_alloc(sizeof(dm_table_entry_t), - KM_NOSLEEP)) == NULL) { + KM_SLEEP)) == NULL) { dm_table_release(&dmv->table_head, DM_TABLE_INACTIVE); dm_dev_unbusy(dmv); return ENOMEM; @@ -913,7 +913,7 @@ dm_table_status_ioctl(prop_dictionary_t dm_dict) prop_dictionary_set_cstring(target_dict, DM_TABLE_PARAMS, params); - kmem_free(params, strlen(params) + 1); + kmem_free(params, DM_MAX_PARAMS_SIZE); } } -- cgit