svn commit: r326809 - head/sys/dev/cardbus
Warner Losh
imp at FreeBSD.org
Tue Dec 12 20:22:11 UTC 2017
Author: imp
Date: Tue Dec 12 20:22:09 2017
New Revision: 326809
URL: https://svnweb.freebsd.org/changeset/base/326809
Log:
1k objects on the stack are a bad idea. While it's likely safe in this
context, it's also safe to allocate the memory and free it instead.
Noticed by: Eugene Grosbein's script
Modified:
head/sys/dev/cardbus/cardbus_cis.c
Modified: head/sys/dev/cardbus/cardbus_cis.c
==============================================================================
--- head/sys/dev/cardbus/cardbus_cis.c Tue Dec 12 20:15:57 2017 (r326808)
+++ head/sys/dev/cardbus/cardbus_cis.c Tue Dec 12 20:22:09 2017 (r326809)
@@ -583,7 +583,7 @@ int
cardbus_parse_cis(device_t cbdev, device_t child,
struct tuple_callbacks *callbacks, void *argp)
{
- uint8_t tupledata[MAXTUPLESIZE];
+ uint8_t *tupledata;
int tupleid = CISTPL_NULL;
int len;
int expect_linktarget;
@@ -591,10 +591,11 @@ cardbus_parse_cis(device_t cbdev, device_t child,
struct resource *res;
int rid;
- bzero(tupledata, MAXTUPLESIZE);
+ tupledata = malloc(MAXTUPLESIZE, M_DEVBUF, M_WAITOK | M_ZERO);
expect_linktarget = TRUE;
if ((start = pci_read_config(child, PCIR_CIS, 4)) == 0) {
DEVPRINTF((cbdev, "Warning: CIS pointer is 0: (no CIS)\n"));
+ free(tupledata, M_DEVBUF);
return (0);
}
DEVPRINTF((cbdev, "CIS pointer is %#x\n", start));
@@ -602,6 +603,7 @@ cardbus_parse_cis(device_t cbdev, device_t child,
res = cardbus_read_tuple_init(cbdev, child, &start, &rid);
if (res == NULL) {
device_printf(cbdev, "Unable to allocate resources for CIS\n");
+ free(tupledata, M_DEVBUF);
return (ENXIO);
}
@@ -610,6 +612,7 @@ cardbus_parse_cis(device_t cbdev, device_t child,
&tupleid, &len, tupledata) != 0) {
device_printf(cbdev, "Failed to read CIS.\n");
cardbus_read_tuple_finish(cbdev, child, rid, res);
+ free(tupledata, M_DEVBUF);
return (ENXIO);
}
@@ -617,6 +620,7 @@ cardbus_parse_cis(device_t cbdev, device_t child,
device_printf(cbdev, "Expecting link target, got 0x%x\n",
tupleid);
cardbus_read_tuple_finish(cbdev, child, rid, res);
+ free(tupledata, M_DEVBUF);
return (EINVAL);
}
expect_linktarget = decode_tuple(cbdev, child, tupleid, len,
@@ -625,10 +629,12 @@ cardbus_parse_cis(device_t cbdev, device_t child,
device_printf(cbdev, "Parsing failed with %d\n",
expect_linktarget);
cardbus_read_tuple_finish(cbdev, child, rid, res);
+ free(tupledata, M_DEVBUF);
return (expect_linktarget);
}
} while (tupleid != CISTPL_END);
cardbus_read_tuple_finish(cbdev, child, rid, res);
+ free(tupledata, M_DEVBUF);
return (0);
}
More information about the svn-src-head
mailing list