Index: dev/isa/isa.c
===================================================================
RCS file: /cvs/src/sys/dev/isa/isa.c,v
retrieving revision 1.39
diff -u -r1.39 isa.c
--- dev/isa/isa.c 3 Jun 2003 21:09:02 -0000 1.39
+++ dev/isa/isa.c 13 Apr 2007 12:36:11 -0000
@@ -201,7 +201,14 @@
ia.ia_delaybah = sc->sc_delaybah;
if (cf->cf_fstate == FSTATE_STAR) {
- struct isa_attach_args ia2 = ia;
+ struct isa_attach_args *ia2p = malloc(sizeof(*ia2p), M_DEVBUF, M_NOWAIT);
+ if (!ia2p) {
+ printf("isascan: no mem for ia2p\n");
+ free(dev, M_DEVBUF);
+ return;
+ }
+#define ia2 (*ia2p)
+ ia2 = ia;
if (autoconf_verbose)
printf(">>> probing for %s*\n",
@@ -241,6 +248,8 @@
printf(">>> probing for %s* finished\n",
cf->cf_driver->cd_name);
free(dev, M_DEVBUF);
+ free(ia2p, M_DEVBUF);
+#undef ia2
return;
}
Index: dev/ic/twe.c
===================================================================
RCS file: /cvs/src/sys/dev/ic/twe.c,v
retrieving revision 1.27
diff -u -r1.27 twe.c
--- dev/ic/twe.c 29 Dec 2006 13:04:37 -0000 1.27
+++ dev/ic/twe.c 13 Apr 2007 12:36:11 -0000
@@ -131,7 +131,8 @@
{
struct scsibus_attach_args saa;
/* this includes a buffer for drive config req, and a capacity req */
- u_int8_t param_buf[2 * TWE_SECTOR_SIZE + TWE_ALIGN - 1];
+ u_int8_t *param_buf = malloc(2 * TWE_SECTOR_SIZE + TWE_ALIGN - 1,
+ M_DEVBUF, M_NOWAIT);
struct twe_param *pb = (void *)
(((u_long)param_buf + TWE_ALIGN - 1) & ~(TWE_ALIGN - 1));
struct twe_param *cap = (void *)((u_int8_t *)pb + TWE_SECTOR_SIZE);
@@ -143,10 +144,17 @@
twe_lock_t lock;
paddr_t pa;
+ if (!param_buf) {
+ printf(": cannot allocate param_buf\n");
+ return (1);
+ }
+
+
error = bus_dmamem_alloc(sc->dmat, sizeof(struct twe_cmd) * TWE_MAXCMDS,
PAGE_SIZE, 0, sc->sc_cmdseg, 1, &nseg, BUS_DMA_NOWAIT);
if (error) {
printf(": cannot allocate commands (%d)\n", error);
+ free(param_buf, M_DEVBUF);
return (1);
}
@@ -156,6 +164,7 @@
if (error) {
printf(": cannot map commands (%d)\n", error);
bus_dmamem_free(sc->dmat, sc->sc_cmdseg, 1);
+ free(param_buf, M_DEVBUF);
return (1);
}
@@ -166,6 +175,7 @@
if (error) {
printf(": cannot create ccb cmd dmamap (%d)\n", error);
twe_dispose(sc);
+ free(param_buf, M_DEVBUF);
return (1);
}
error = bus_dmamap_load(sc->dmat, sc->sc_cmdmap, sc->sc_cmds,
@@ -173,6 +183,7 @@
if (error) {
printf(": cannot load command dma map (%d)\n", error);
twe_dispose(sc);
+ free(param_buf, M_DEVBUF);
return (1);
}
@@ -196,6 +207,7 @@
if (error) {
printf(": cannot create ccb dmamap (%d)\n", error);
twe_dispose(sc);
+ free(param_buf, M_DEVBUF);
return (1);
}
ccb->ccb_sc = sc;
@@ -308,12 +320,14 @@
if (retry < 0) {
printf(errstr);
twe_dispose(sc);
+ free(param_buf, M_DEVBUF);
return 1;
}
if ((ccb = twe_get_ccb(sc)) == NULL) {
printf(": out of ccbs\n");
twe_dispose(sc);
+ free(param_buf, M_DEVBUF);
return 1;
}
@@ -332,6 +346,7 @@
if (twe_cmd(ccb, BUS_DMA_NOWAIT, 1)) {
printf(": failed to fetch unit parameters\n");
twe_dispose(sc);
+ free(param_buf, M_DEVBUF);
return 1;
}
@@ -345,6 +360,7 @@
if ((ccb = twe_get_ccb(sc)) == NULL) {
printf(": out of ccbs\n");
twe_dispose(sc);
+ free(param_buf, M_DEVBUF);
return 1;
}
@@ -396,6 +412,7 @@
kthread_create_deferred(twe_thread_create, sc);
+ free(param_buf, M_DEVBUF);
return (0);
}
@@ -1009,6 +1026,9 @@
if (status & TWE_STAT_ATTNI) {
u_int16_t aen;
+ u_int8_t *param_buf = malloc(2 * TWE_SECTOR_SIZE + TWE_ALIGN - 1, M_DEVBUF, M_NOWAIT);
+ struct twe_param *pb = (void *) (((u_long)param_buf +
+ TWE_ALIGN - 1) & ~(TWE_ALIGN - 1));
/*
* we know no attentions of interest right now.
@@ -1019,12 +1039,13 @@
bus_space_write_4(sc->iot, sc->ioh, TWE_CONTROL,
TWE_CTRL_CATTNI);
+ if (!param_buf) {
+ printf("%s: no mem for param_buf\n", sc->sc_dev.dv_xname);
+ return (rv);
+ }
+
lock = TWE_LOCK(sc);
for (aen = -1; aen != TWE_AEN_QEMPTY; ) {
- u_int8_t param_buf[2 * TWE_SECTOR_SIZE + TWE_ALIGN - 1];
- struct twe_param *pb = (void *) (((u_long)param_buf +
- TWE_ALIGN - 1) & ~(TWE_ALIGN - 1));
-
if ((ccb = twe_get_ccb(sc)) == NULL)
break;
@@ -1049,6 +1070,7 @@
TWE_DPRINTF(TWE_D_AEN, ("aen=%x ", aen));
}
TWE_UNLOCK(sc, lock);
+ free(param_buf, M_DEVBUF);
}
return rv;
Index: net/zlib.c
===================================================================
RCS file: /cvs/src/sys/net/zlib.c,v
retrieving revision 1.12
diff -u -r1.12 zlib.c
--- net/zlib.c 10 Dec 2003 07:22:42 -0000 1.12
+++ net/zlib.c 13 Apr 2007 12:36:12 -0000
@@ -39,6 +39,7 @@
#include <stand.h>
#else
#include <sys/systm.h>
+#include <sys/malloc.h>
#endif
#ifndef local
@@ -3735,7 +3736,11 @@
inflate_huft *q; /* points to current table */
struct inflate_huft_s r; /* table entry for structure assignment */
inflate_huft *u[BMAX]; /* table stack */
- uInt v[N_MAX]; /* values in order of bit length */
+#ifndef _STANDALONE
+ uInt *v; /* values in order of bit length */
+#else
+ uInt v[N_MAX];
+#endif
int w; /* bits before this table == (l * h) */
uInt x[BMAX+1]; /* bit offsets, then code stack */
uIntf *xp; /* pointer into x */
@@ -3794,6 +3799,11 @@
*xp++ = (j += *p++);
}
+#ifndef _STANDALONE
+ v = malloc(N_MAX * sizeof(*v), M_TEMP, M_NOWAIT);
+ if (!v)
+ return Z_MEM_ERROR;
+#endif
/* Make a table of values in order of bit lengths */
p = b; i = 0;
@@ -3847,6 +3857,9 @@
{
if (h)
inflate_trees_free(u[0], zs);
+#ifndef _STANDALONE
+ free(v, M_TEMP);
+#endif
return Z_MEM_ERROR; /* not enough memory */
}
q->word.Nalloc = z + 1;
@@ -3903,6 +3916,9 @@
}
}
+#ifndef _STANDALONE
+ free(v, M_TEMP);
+#endif
/* Return Z_BUF_ERROR if we were given an incomplete table */
return y != 0 && g != 1 ? Z_BUF_ERROR : Z_OK;
Is this really worth doing? isa can only attach children at boot time,
and we do not hotplug pci yet. So all the code you've been changed is
only invoked in reasonably safe circumstances.
Miod
fair enough. i was chasing rumors of large stack use in the xfs code,
so i turned down the warning limit to see what popped up. this was
it.
Those are indeed among the worst offenders.
As far as xfs is concerned, the only routine over 1KB I have in my logs
is lookup_node() in xfs/xfs_syscalls-common.c, which uses 1136 bytes on
32 bit platforms and 1264 bytes on 64 bit platforms.
Miod