svn commit: r207198 - stable/8/sys/kern

[Warner Losh]

Author: imp
Date: Sun Apr 25 19:13:08 2010
New Revision: 207198
URL: http://svn.freebsd.org/changeset/base/207198

Log:
  MFC r206916
  
    Make sure that we free the passed in data message if we don't actually
    insert it onto the queue.  Also, fix a mtx leak if someone turns off
    devctl while we're processing a messages.
  
    MFC after:	5 days

Modified:
  stable/8/sys/kern/subr_bus.c
Directory Properties:
  stable/8/sys/   (props changed)
  stable/8/sys/amd64/include/xen/   (props changed)
  stable/8/sys/cddl/contrib/opensolaris/   (props changed)
  stable/8/sys/contrib/dev/acpica/   (props changed)
  stable/8/sys/contrib/pf/   (props changed)
  stable/8/sys/dev/xen/xenpci/   (props changed)
  stable/8/sys/geom/sched/   (props changed)

Modified: stable/8/sys/kern/subr_bus.c
==============================================================================
--- stable/8/sys/kern/subr_bus.c	Sun Apr 25 19:00:37 2010	(r207197)
+++ stable/8/sys/kern/subr_bus.c	Sun Apr 25 19:13:08 2010	(r207198)
@@ -545,15 +545,16 @@ devctl_queue_data(char *data)
 	struct proc *p;
 
 	if (strlen(data) == 0)
-		return;
+		goto out;
 	if (devctl_queue_length == 0)
-		return;
+		goto out;
 	n1 = malloc(sizeof(*n1), M_BUS, M_NOWAIT);
 	if (n1 == NULL)
-		return;
+		goto out;
 	n1->dei_data = data;
 	mtx_lock(&devsoftc.mtx);
 	if (devctl_queue_length == 0) {
+		mtx_unlock(&devsoftc.mtx);
 		free(n1->dei_data, M_BUS);
 		free(n1, M_BUS);
 		return;
@@ -577,6 +578,14 @@ devctl_queue_data(char *data)
 		psignal(p, SIGIO);
 		PROC_UNLOCK(p);
 	}
+	return;
+out:
+	/*
+	 * We have to free data on all error paths since the caller
+	 * assumes it will be free'd when this item is dequeued.
+	 */
+	free(data, M_BUS);
+	return;
 }
 
 /**