This is a patch that I currently use to fix the problem for myself - both 2KB
structs are allocated on the heap.
I am not sure what is the proper style for chained calls using chained if-else,
but I think that the chaining is the best way to organize that piece of code, so
that there is only one exit point from case-block to make sure that FREE is
always
called.
diff --git a/sys/compat/linux/linux_ioctl.c b/sys/compat/linux/linux_ioctl.c
index 8e42ec1..7e3453c 100644
--- a/sys/compat/linux/linux_ioctl.c
+++ b/sys/compat/linux/linux_ioctl.c
@@ -1538,23 +1538,28 @@ linux_ioctl_cdrom(struct thread *td, struct
linux_ioctl_args *args)
/* LINUX_CDROMAUDIOBUFSIZ */
case LINUX_DVD_READ_STRUCT: {
- l_dvd_struct lds;
- struct dvd_struct bds;
+ l_dvd_struct *p_lds;
+ struct dvd_struct *p_bds;
- error = copyin((void *)args->arg, &lds, sizeof(lds));
- if (error)
- break;
- error = linux_to_bsd_dvd_struct(&lds, &bds);
- if (error)
- break;
- error = fo_ioctl(fp, DVDIOCREADSTRUCTURE, (caddr_t)&bds,
- td->td_ucred, td);
- if (error)
- break;
- error = bsd_to_linux_dvd_struct(&bds, &lds);
- if (error)
- break;
- error = copyout(&lds, (void *)args->arg, sizeof(lds));
+ MALLOC(p_lds, l_dvd_struct *, sizeof(*p_lds),
+ M_LINUX, M_WAITOK);
+ MALLOC(p_bds, struct dvd_struct *, sizeof(*p_bds),
+ M_LINUX, M_WAITOK);
+ if ((error = copyin((void *)args->arg, p_lds, sizeof(*p_lds)))
+ != 0)
+ ; /* nothing */
+ else if ((error = linux_to_bsd_dvd_struct(p_lds, p_bds)) != 0)
+ ; /* nothing */
+ else if ((error = fo_ioctl(fp, DVDIOCREADSTRUCTURE,
+ (caddr_t)p_bds, td->td_ucred, td)) != 0)
+ ; /* nothing */
+ else if ((error = bsd_to_linux_dvd_struct(p_bds, p_lds)) != 0)
+ ; /* nothing */
+ else
+ error = copyout(p_lds, (void *)args->arg,
+ sizeof(*p_lds));
+ FREE(p_bds, M_LINUX);
+ FREE(p_lds, M_LINUX);
break;
}
--
Andriy Gapon
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscr...@freebsd.org"
