[src/trunk]: src/sys/arch/sparc64/dev sun4v: Fixed PR 51554 - Avoid unsafe al...

[palle <palle%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/03faa733add6
branches:  trunk
changeset: 351894:03faa733add6
user:      palle <palle%NetBSD.org@localhost>
date:      Fri Mar 03 21:09:25 2017 +0000

description:
sun4v: Fixed PR 51554 - Avoid unsafe allocation in ldc/vdsk

diffstat:

 sys/arch/sparc64/dev/ldc.c  |  12 +++++++++++-
 sys/arch/sparc64/dev/vdsk.c |   7 ++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diffs (75 lines):

diff -r 76572648803f -r 03faa733add6 sys/arch/sparc64/dev/ldc.c
--- a/sys/arch/sparc64/dev/ldc.c        Fri Mar 03 20:48:02 2017 +0000
+++ b/sys/arch/sparc64/dev/ldc.c        Fri Mar 03 21:09:25 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ldc.c,v 1.2 2016/08/20 18:21:18 nakayama Exp $ */
+/*     $NetBSD: ldc.c,v 1.3 2017/03/03 21:09:25 palle Exp $    */
 /*     $OpenBSD: ldc.c,v 1.12 2015/03/21 18:02:58 kettenis Exp $       */
 /*
  * Copyright (c) 2009 Mark Kettenis
@@ -554,6 +554,8 @@
                goto unmap;
 #else
         va = (vaddr_t)kmem_zalloc(size, KM_NOSLEEP);
+        if (va == 0)
+               goto free;
 #endif
        lq->lq_va = (vaddr_t)va;
        lq->lq_nentries = nentries;
@@ -565,6 +567,9 @@
        bus_dmamem_free(t, &lq->lq_seg, 1);
 destroy:
        bus_dmamap_destroy(t, lq->lq_map);
+#else
+free:
+       kmem_free(lq, sizeof(struct ldc_queue));
 #endif
        return (NULL);
 }
@@ -637,6 +642,8 @@
        }
 #else
        va = (vaddr_t)kmem_zalloc(size, KM_NOSLEEP);
+       if (va == 0)
+               goto free;
 #endif
        lm->lm_slot = (struct ldc_map_slot *)va;
        lm->lm_nentries = nentries;
@@ -650,6 +657,9 @@
        bus_dmamem_free(t, &lm->lm_seg, 1);
 destroy:
        bus_dmamap_destroy(t, lm->lm_map);
+#else
+free:
+       kmem_free(lm, sizeof(struct ldc_map));
 #endif
        return (NULL);
 }
diff -r 76572648803f -r 03faa733add6 sys/arch/sparc64/dev/vdsk.c
--- a/sys/arch/sparc64/dev/vdsk.c       Fri Mar 03 20:48:02 2017 +0000
+++ b/sys/arch/sparc64/dev/vdsk.c       Fri Mar 03 21:09:25 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: vdsk.c,v 1.2 2016/08/20 18:21:18 nakayama Exp $        */
+/*     $NetBSD: vdsk.c,v 1.3 2017/03/03 21:09:25 palle Exp $   */
 /*     $OpenBSD: vdsk.c,v 1.46 2015/01/25 21:42:13 kettenis Exp $      */
 /*
  * Copyright (c) 2009, 2011 Mark Kettenis
@@ -969,6 +969,8 @@
                goto unmap;
 #else
        va = (vaddr_t)kmem_zalloc(size, KM_NOSLEEP);
+       if (va == 0)
+               goto free;
 #endif
        vd->vd_desc = (struct vd_desc *)va;
        vd->vd_nentries = nentries;
@@ -984,6 +986,9 @@
        bus_dmamem_free(t, &vd->vd_seg, 1);
 destroy:
        bus_dmamap_destroy(t, vd->vd_map);
+#else
+free:
+       kmem_free(vd, sizeof(struct vdsk_dring));
 #endif
        return (NULL);
 }