Sat Apr 4 14:12:40 2015 UTC ()
don't malloc a tiny, fixed size buffer to scribble into, then not use it
and never free it either

found by Brainy


(macallan)
diff -r1.7 -r1.8 src/sys/arch/sgimips/dev/scn.c
cvs diff -r1.7 -r1.8 src/sys/arch/sgimips/dev/scn.c (expand / switch to unified diff)

--- src/sys/arch/sgimips/dev/scn.c 2014/07/25 08:10:34 1.7
+++ src/sys/arch/sgimips/dev/scn.c 2015/04/04 14:12:40 1.8
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: scn.c,v 1.7 2014/07/25 08:10:34 dholland Exp $ */ 1/* $NetBSD: scn.c,v 1.8 2015/04/04 14:12:40 macallan Exp $ */
2 2
3/* 3/*
4 * Resurrected from the old pc532 port 1/18/2009. 4 * Resurrected from the old pc532 port 1/18/2009.
5 * 5 *
6 * XXX- The locking in this is probably totally broken. I haven't attempted 6 * XXX- The locking in this is probably totally broken. I haven't attempted
7 * to get it right, but it seems to work okay anyhow. 7 * to get it right, but it seems to work okay anyhow.
8 */ 8 */
9 9
10/* 10/*
11 * Copyright (c) 1991, 1992, 1993 11 * Copyright (c) 1991, 1992, 1993
12 * The Regents of the University of California. All rights reserved. 12 * The Regents of the University of California. All rights reserved.
13 * 13 *
14 * Portions of this software were developed by the Computer Systems 14 * Portions of this software were developed by the Computer Systems
@@ -82,27 +82,27 @@ @@ -82,27 +82,27 @@
82 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 82 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
83 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 83 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
84 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 84 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
85 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 85 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
86 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 86 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
87 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 87 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
88 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 88 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
89 * SUCH DAMAGE. 89 * SUCH DAMAGE.
90 * 90 *
91 * from: @(#)com.c 7.5 (Berkeley) 5/16/91 91 * from: @(#)com.c 7.5 (Berkeley) 5/16/91
92 */ 92 */
93 93
94#include <sys/cdefs.h> 94#include <sys/cdefs.h>
95__KERNEL_RCSID(0, "$NetBSD: scn.c,v 1.7 2014/07/25 08:10:34 dholland Exp $"); 95__KERNEL_RCSID(0, "$NetBSD: scn.c,v 1.8 2015/04/04 14:12:40 macallan Exp $");
96 96
97#include "opt_ddb.h" 97#include "opt_ddb.h"
98#include "opt_kgdb.h" 98#include "opt_kgdb.h"
99#include "scn.h" 99#include "scn.h"
100 100
101#include <sys/param.h> 101#include <sys/param.h>
102#include <sys/systm.h> 102#include <sys/systm.h>
103#include <sys/ioctl.h> 103#include <sys/ioctl.h>
104#include <sys/select.h> 104#include <sys/select.h>
105#include <sys/tty.h> 105#include <sys/tty.h>
106#include <sys/proc.h> 106#include <sys/proc.h>
107#include <sys/file.h> 107#include <sys/file.h>
108#include <sys/uio.h> 108#include <sys/uio.h>
@@ -805,27 +805,26 @@ scn_attach(device_t parent, device_t sel @@ -805,27 +805,26 @@ scn_attach(device_t parent, device_t sel
805 struct duart *duart; 805 struct duart *duart;
806 volatile u_char *ch_base; 806 volatile u_char *ch_base;
807 volatile u_char *duart_base; 807 volatile u_char *duart_base;
808 int channel; 808 int channel;
809 int speed; 809 int speed;
810 int s; 810 int s;
811 int maj __diagused; 811 int maj __diagused;
812 u_char unit; 812 u_char unit;
813 u_char duartno; 813 u_char duartno;
814 u_char delim = ':'; 814 u_char delim = ':';
815 u_char mr1, mr2; 815 u_char mr1, mr2;
816 enum scntype scntype = SCNUNK; 816 enum scntype scntype = SCNUNK;
817 const char *duart_type = "Unknown"; 817 const char *duart_type = "Unknown";
818 char *intrname; 
819 bool console, first; 818 bool console, first;
820 devmajor_t major; 819 devmajor_t major;
821 820
822 (void)major; 821 (void)major;
823 822
824 sc = device_private(self); 823 sc = device_private(self);
825 unit = device_unit(self); 824 unit = device_unit(self);
826 825
827 /* XXX - hard-coded */ 826 /* XXX - hard-coded */
828 if (ma->ma_addr == 0x1fb80004) 827 if (ma->ma_addr == 0x1fb80004)
829 duartno = 1; 828 duartno = 1;
830 else 829 else
831 duartno = 0; 830 duartno = 0;
@@ -896,29 +895,26 @@ scn_attach(device_t parent, device_t sel @@ -896,29 +895,26 @@ scn_attach(device_t parent, device_t sel
896 } 895 }
897 896
898 /* If a 2681, the CR_CMD_MR0 is interpreted as a TX_RESET */ 897 /* If a 2681, the CR_CMD_MR0 is interpreted as a TX_RESET */
899 if (console) { 898 if (console) {
900 ch_base[CH_CR] = CR_ENA_TX; 899 ch_base[CH_CR] = CR_ENA_TX;
901 RECOVER(); 900 RECOVER();
902 } 901 }
903 ch_base[CH_CR] = CR_CMD_MR1; 902 ch_base[CH_CR] = CR_CMD_MR1;
904 RECOVER(); 903 RECOVER();
905 ch_base[CH_MR] = mr1; 904 ch_base[CH_MR] = mr1;
906 ch_base[CH_MR] = mr2; 905 ch_base[CH_MR] = mr2;
907 splx(s); 906 splx(s);
908 907
909 intrname = malloc(sizeof("scnXX"), M_DEVBUF, M_NOWAIT); 
910 snprintf(intrname, sizeof("scnXX"), "scn%d", unit); 
911 
912 /* 908 /*
913 * On IP6 the console chip is duart1. The keyboard/mouse 909 * On IP6 the console chip is duart1. The keyboard/mouse
914 * is duart0. Each chip has two channels and the channels 910 * is duart0. Each chip has two channels and the channels
915 * share an interrupt. Duart0 is interrupt 0, duart1 is 911 * share an interrupt. Duart0 is interrupt 0, duart1 is
916 * interrupt 1. 912 * interrupt 1.
917 */ 913 */
918 if (duartno != 0 && duartno != 1) 914 if (duartno != 0 && duartno != 1)
919 panic("scn_attach: bad duartno: %d", duartno); 915 panic("scn_attach: bad duartno: %d", duartno);
920 cpu_intr_establish(duartno, IPL_TTY, scnintr, duart); 916 cpu_intr_establish(duartno, IPL_TTY, scnintr, duart);
921 917
922 printf("%c %s", delim, duart_type); 918 printf("%c %s", delim, duart_type);
923 delim = ','; 919 delim = ',';
924 920