svn commit: r326809 - head/sys/dev/cardbus

[Warner Losh]

Author: imp
Date: Tue Dec 12 20:22:09 2017
New Revision: 326809
URL: https://svnweb.freebsd.org/changeset/base/326809

Log:
  1k objects on the stack are a bad idea. While it's likely safe in this
  context, it's also safe to allocate the memory and free it instead.
  
  Noticed by: Eugene Grosbein's script

Modified:
  head/sys/dev/cardbus/cardbus_cis.c

Modified: head/sys/dev/cardbus/cardbus_cis.c
==============================================================================
--- head/sys/dev/cardbus/cardbus_cis.c  Tue Dec 12 20:15:57 2017        
(r326808)
+++ head/sys/dev/cardbus/cardbus_cis.c  Tue Dec 12 20:22:09 2017        
(r326809)
@@ -583,7 +583,7 @@ int
 cardbus_parse_cis(device_t cbdev, device_t child,
     struct tuple_callbacks *callbacks, void *argp)
 {
-       uint8_t tupledata[MAXTUPLESIZE];
+       uint8_t *tupledata;
        int tupleid = CISTPL_NULL;
        int len;
        int expect_linktarget;
@@ -591,10 +591,11 @@ cardbus_parse_cis(device_t cbdev, device_t child,
        struct resource *res;
        int rid;
 
-       bzero(tupledata, MAXTUPLESIZE);
+       tupledata = malloc(MAXTUPLESIZE, M_DEVBUF, M_WAITOK | M_ZERO);
        expect_linktarget = TRUE;
        if ((start = pci_read_config(child, PCIR_CIS, 4)) == 0) {
                DEVPRINTF((cbdev, "Warning: CIS pointer is 0: (no CIS)\n"));
+               free(tupledata, M_DEVBUF);
                return (0);
        }
        DEVPRINTF((cbdev, "CIS pointer is %#x\n", start));
@@ -602,6 +603,7 @@ cardbus_parse_cis(device_t cbdev, device_t child,
        res = cardbus_read_tuple_init(cbdev, child, &start, &rid);
        if (res == NULL) {
                device_printf(cbdev, "Unable to allocate resources for CIS\n");
+               free(tupledata, M_DEVBUF);
                return (ENXIO);
        }
 
@@ -610,6 +612,7 @@ cardbus_parse_cis(device_t cbdev, device_t child,
                    &tupleid, &len, tupledata) != 0) {
                        device_printf(cbdev, "Failed to read CIS.\n");
                        cardbus_read_tuple_finish(cbdev, child, rid, res);
+                       free(tupledata, M_DEVBUF);
                        return (ENXIO);
                }
 
@@ -617,6 +620,7 @@ cardbus_parse_cis(device_t cbdev, device_t child,
                        device_printf(cbdev, "Expecting link target, got 
0x%x\n",
                            tupleid);
                        cardbus_read_tuple_finish(cbdev, child, rid, res);
+                       free(tupledata, M_DEVBUF);
                        return (EINVAL);
                }
                expect_linktarget = decode_tuple(cbdev, child, tupleid, len,
@@ -625,10 +629,12 @@ cardbus_parse_cis(device_t cbdev, device_t child,
                        device_printf(cbdev, "Parsing failed with %d\n",
                            expect_linktarget);
                        cardbus_read_tuple_finish(cbdev, child, rid, res);
+                       free(tupledata, M_DEVBUF);
                        return (expect_linktarget);
                }
        } while (tupleid != CISTPL_END);
        cardbus_read_tuple_finish(cbdev, child, rid, res);
+       free(tupledata, M_DEVBUF);
        return (0);
 }
 
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"