6521864 Niagara-2 page retirement leaks memory

3 files changed, 20 insertions, 11 deletions

diff --git a/usr/src/cmd/fm/modules/sun4/cpumem-diagnosis/cmd_dimm.c b/usr/src/cmd/fm/modules/sun4/cpumem-diagnosis/cmd_dimm.c
index 82d6ffdb59..26a53a065b 100644
--- a/usr/src/cmd/fm/modules/sun4/cpumem-diagnosis/cmd_dimm.c
+++ b/usr/src/cmd/fm/modules/sun4/cpumem-diagnosis/cmd_dimm.c
@@ -81,8 +81,12 @@ cmd_dimm_create_fault(fmd_hdl_t *hdl, cmd_dimm_t *dimm, const char *fltnm,
     uint_t cert)
 {
 #ifdef sun4v
-	nvlist_t *flt = fmd_nvl_create_fault(hdl, fltnm, cert,
-	    dimm->dimm_asru_nvl, cmd_mem2hc(hdl, dimm->dimm_asru_nvl), NULL);
+	nvlist_t *flt, *nvlfru;
+	nvlfru = cmd_mem2hc(hdl, dimm->dimm_asru_nvl);
+	flt = fmd_nvl_create_fault(hdl, fltnm, cert,
+	    dimm->dimm_asru_nvl, nvlfru, NULL);
+	if (nvlfru != NULL)
+		nvlist_free(nvlfru);
 	return (cmd_fault_add_location(hdl, flt, dimm->dimm_unum));
 #else
 	return (fmd_nvl_create_fault(hdl, fltnm, cert, dimm->dimm_asru_nvl,
diff --git a/usr/src/cmd/fm/modules/sun4/cpumem-diagnosis/cmd_pageerr.c b/usr/src/cmd/fm/modules/sun4/cpumem-diagnosis/cmd_pageerr.c
index c11c3ce661..5076d3e309 100644
--- a/usr/src/cmd/fm/modules/sun4/cpumem-diagnosis/cmd_pageerr.c
+++ b/usr/src/cmd/fm/modules/sun4/cpumem-diagnosis/cmd_pageerr.c
@@ -48,7 +48,7 @@ cmd_page_fault(fmd_hdl_t *hdl, nvlist_t *modasru, nvlist_t *modfru,
 {
 	cmd_page_t *page = cmd_page_lookup(afar);
 	const char *uuid;
-	nvlist_t *flt;
+	nvlist_t *flt, *nvlfru;
 
 	if (page == NULL)
 		page = cmd_page_create(hdl, modasru, afar);
@@ -66,9 +66,12 @@ cmd_page_fault(fmd_hdl_t *hdl, nvlist_t *modasru, nvlist_t *modfru,
 	    CMD_PTR_PAGE_CASE, &uuid);
 
 #ifdef sun4v
+	nvlfru = cmd_mem2hc(hdl, modfru);
 	flt = fmd_nvl_create_fault(hdl, "fault.memory.page", 100,
-	    page->page_asru_nvl, cmd_mem2hc(hdl, modfru), NULL);
+	    page->page_asru_nvl, nvlfru, NULL);
 	flt = cmd_fault_add_location(hdl, flt, cmd_fmri_get_unum(modfru));
+	if (nvlfru != NULL)
+		nvlist_free(nvlfru);
 #else /* sun4v */
 	flt = fmd_nvl_create_fault(hdl, "fault.memory.page", 100,
 	    page->page_asru_nvl, modfru, NULL);
diff --git a/usr/src/cmd/fm/modules/sun4v/cpumem-diagnosis/cmd_memerr_arch.c b/usr/src/cmd/fm/modules/sun4v/cpumem-diagnosis/cmd_memerr_arch.c
index be3ecc404c..975ebf6d49 100644
--- a/usr/src/cmd/fm/modules/sun4v/cpumem-diagnosis/cmd_memerr_arch.c
+++ b/usr/src/cmd/fm/modules/sun4v/cpumem-diagnosis/cmd_memerr_arch.c
@@ -474,7 +474,7 @@ cmd_mem2hc(fmd_hdl_t *hdl, nvlist_t *mem_fmri) {
 
 	if (breakup_components(nac_name, "/", hc_list) < 0) {
 		fmd_hdl_error(hdl, "cannot allocate components for hc-list\n");
-		for (i = 0; i < n; n++) {
+		for (i = 0; i < n; i++) {
 			if (hc_list[i] != NULL)
 			    nvlist_free(hc_list[i]);
 		}
@@ -489,18 +489,20 @@ cmd_mem2hc(fmd_hdl_t *hdl, nvlist_t *mem_fmri) {
 	    (nvlist_add_string(fp, FM_FMRI_HC_ROOT, "/") != 0) ||
 	    (nvlist_add_uint32(fp, FM_FMRI_HC_LIST_SZ, n) != 0) ||
 	    (nvlist_add_nvlist_array(fp, FM_FMRI_HC_LIST, hc_list, n) != 0)) {
-		for (i = 0; i < n; n++) {
-			nvlist_free(hc_list[i]);
+		for (i = 0; i < n; i++) {
+			if (hc_list[i] != NULL)
+				nvlist_free(hc_list[i]);
 		}
 		fmd_hdl_free(hdl, hc_list, sizeof (nvlist_t *)*n);
 		fmd_hdl_free(hdl, nac_name, strlen(unum)+1);
 		nvlist_free(fp);
 		return (NULL);
 	}
-	/*
-	 * if the nvlist_add_nvlist_array succeeds, then it frees
-	 * the hc_list[i]'s.
-	 */
+
+	for (i = 0; i < n; i++) {
+		if (hc_list[i] != NULL)
+			nvlist_free(hc_list[i]);
+	}
 	fmd_hdl_free(hdl, hc_list, sizeof (nvlist_t *)*n);
 	fmd_hdl_free(hdl, nac_name, strlen(unum)+1);
 	if (nvlist_lookup_string_array(mem_fmri, FM_FMRI_HC_SERIAL_ID,