kernel: fix more malloc bugs

28 files changed, 192 insertions, 54 deletions

diff --git a/sys/src/9/pc/audioac97.c b/sys/src/9/pc/audioac97.c
index e0732dd6b..ea0e16016 100644
--- a/sys/src/9/pc/audioac97.c
+++ b/sys/src/9/pc/audioac97.c
@@ -389,6 +389,10 @@ ac97reset(Audio *adev)
 		p = nil;
 		while(p = ac97match(p)){
 			ctlr = xspanalloc(sizeof(Ctlr), 8, 0);
+			if(ctlr == nil){
+				print("ac97: can't allocate memory\n");
+				break;
+			}
 			memset(ctlr, 0, sizeof(Ctlr));
 			ctlr->pcidev = p;
 			ctlr->next = cards;
diff --git a/sys/src/9/pc/audioac97mix.c b/sys/src/9/pc/audioac97mix.c
index 6d12a46a3..bb27d3866 100644
--- a/sys/src/9/pc/audioac97mix.c
+++ b/sys/src/9/pc/audioac97mix.c
@@ -238,6 +238,10 @@ ac97mixreset(Audio *adev, void (*wr)(Audio*,int,ushort), ushort (*rr)(Audio*,int
 	int i;
 
 	m = malloc(sizeof(Mixer));
+	if(m == nil){
+		print("ac97mix: no memory for Mixer\n");
+		return;
+	}
 	m->wr = wr;
 	m->rr = rr;
 	m->wr(adev, Reset, 0);
diff --git a/sys/src/9/pc/audiosb16.c b/sys/src/9/pc/audiosb16.c
index 222f57c5f..09cc6f8be 100644
--- a/sys/src/9/pc/audiosb16.c
+++ b/sys/src/9/pc/audiosb16.c
@@ -682,8 +682,11 @@ audioprobe(Audio *adev)
 	/* make a list of audio isa cards if not already done */
 	if(cards == nil){
 		for(i=0; i<nelem(irq); i++){
-			ctlr = malloc(sizeof(Ctlr));
-			memset(ctlr, 0, sizeof(Ctlr));
+			ctlr = mallocz(sizeof(Ctlr), 1);
+			if(ctlr == nil){
+				print("sb16: can't allocate memory\n");
+				break;
+			}
 			ctlr->conf.port = 0x220 + i*0x10;
 			ctlr->conf.irq = irq[i];
 			ctlr->conf.dma = 0;
diff --git a/sys/src/9/pc/ether2000.c b/sys/src/9/pc/ether2000.c
index 8fc8911e1..7c5c25db7 100644
--- a/sys/src/9/pc/ether2000.c
+++ b/sys/src/9/pc/ether2000.c
@@ -98,8 +98,11 @@ ne2000pnp(Ether* edev)
 			if(p->ccrb != 0x02 || p->ccru != 0)
 				continue;
 			ctlr = malloc(sizeof(Ctlr));
+			if(ctlr == nil){
+				print("ne2000pnp: can't allocate memory\n");
+				continue;
+			}
 			ctlr->pcidev = p;
-
 			if(ctlrhead != nil)
 				ctlrtail->next = ctlr;
 			else
@@ -161,6 +164,11 @@ ne2000reset(Ether* edev)
 		return -1;
 
 	edev->ctlr = malloc(sizeof(Dp8390));
+	if(edev->ctlr == nil){
+		print("ne2000: can't allocate memory\n");
+		iofree(port);
+		return -1;
+	}
 	dp8390 = edev->ctlr;
 	dp8390->width = 2;
 	dp8390->ram = 0;
@@ -228,5 +236,5 @@ ne2000reset(Ether* edev)
 void
 ether2000link(void)
 {
-	addethercard("NE2000", ne2000reset);
+	addethercard("ne2000", ne2000reset);
 }
diff --git a/sys/src/9/pc/ether2114x.c b/sys/src/9/pc/ether2114x.c
index 290b4272f..4e1b6ebdc 100644
--- a/sys/src/9/pc/ether2114x.c
+++ b/sys/src/9/pc/ether2114x.c
@@ -1463,8 +1463,11 @@ srom(Ctlr* ctlr)
 	 * Do a dummy read first to get the size and allocate ctlr->srom.
 	 */
 	sromr(ctlr, 0);
-	if(ctlr->srom == nil)
+	if(ctlr->srom == nil){
 		ctlr->srom = malloc((1<<ctlr->sromsz)*sizeof(ushort));
+		if(ctlr->srom == nil)
+			panic("dec2114x: can't allocate srom");
+	}
 	for(i = 0; i < (1<<ctlr->sromsz); i++){
 		x = sromr(ctlr, i);
 		ctlr->srom[2*i] = x;
@@ -1665,6 +1668,10 @@ dec2114xpci(void)
 		 * bar[1] is the memory-mapped register address.
 		 */
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("dec2114x: can't allocate memory\n");
+			continue;
+		}
 		ctlr->port = p->mem[0].bar & ~0x01;
 		ctlr->pcidev = p;
 		ctlr->id = (p->did<<16)|p->vid;
diff --git a/sys/src/9/pc/ether79c970.c b/sys/src/9/pc/ether79c970.c
index ac1545364..d539cb1d4 100644
--- a/sys/src/9/pc/ether79c970.c
+++ b/sys/src/9/pc/ether79c970.c
@@ -470,6 +470,11 @@ amd79c970pci(void)
 			continue;
 		}
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("amd79c970: can't allocate memory\n");
+			iofree(port);
+			continue;
+		}
 		ctlr->port = p->mem[0].bar & ~0x01;
 		ctlr->pcidev = p;
 
diff --git a/sys/src/9/pc/ether8003.c b/sys/src/9/pc/ether8003.c
index 41244c094..606968f04 100644
--- a/sys/src/9/pc/ether8003.c
+++ b/sys/src/9/pc/ether8003.c
@@ -228,8 +228,13 @@ reset(Ether* ether)
 		return -1;
 	}
 
-	ether->ctlr = malloc(sizeof(Dp8390));
-	ctlr = ether->ctlr;
+	ctlr = malloc(sizeof(Dp8390));
+	if(ctlr == nil){
+		print("ether8003: can't allocate memory\n");
+		iofree(ether->port);
+		return -1;
+	}
+	ether->ctlr = ctlr;
 	ctlr->ram = 1;
 
 	if((id & 0xFE) == 0x2A)
diff --git a/sys/src/9/pc/ether8139.c b/sys/src/9/pc/ether8139.c
index f304df603..bffa7956f 100644
--- a/sys/src/9/pc/ether8139.c
+++ b/sys/src/9/pc/ether8139.c
@@ -454,6 +454,10 @@ rtl8139attach(Ether* edev)
 	if(ctlr->alloc == nil){
 		ctlr->rblen = 1<<((Rblen>>RblenSHIFT)+13);
 		ctlr->alloc = mallocz(ctlr->rblen+16 + Ntd*Tdbsz + 32, 0);
+		if(ctlr->alloc == nil){
+			qunlock(&ctlr->alock);
+			error(Enomem);
+		}
 		rtl8139init(edev);
 	}
 	qunlock(&ctlr->alock);
@@ -752,6 +756,10 @@ rtl8139pnp(Ether* edev)
 			if(p->ccrb != 0x02 || p->ccru != 0)
 				continue;
 			ctlr = malloc(sizeof(Ctlr));
+			if(ctlr == nil){
+				print("rtl8139: can't allocate memory\n");
+				continue;
+			}
 			ctlr->pcidev = p;
 			ctlr->id = (p->did<<16)|p->vid;
 
diff --git a/sys/src/9/pc/ether8169.c b/sys/src/9/pc/ether8169.c
index 020fd69d1..cc27fabea 100644
--- a/sys/src/9/pc/ether8169.c
+++ b/sys/src/9/pc/ether8169.c
@@ -741,15 +741,30 @@ rtl8169attach(Ether* edev)
 
 	ctlr = edev->ctlr;
 	qlock(&ctlr->alock);
-	if(ctlr->init++ == 0){
-		ctlr->td = mallocalign(sizeof(D)*Ntd, 256, 0, 0);
-		ctlr->tb = malloc(Ntd*sizeof(Block*));
+	if(!ctlr->init){
 		ctlr->ntd = Ntd;
-		ctlr->rd = mallocalign(sizeof(D)*Nrd, 256, 0, 0);
-		ctlr->rb = malloc(Nrd*sizeof(Block*));
 		ctlr->nrd = Nrd;
+		ctlr->tb = malloc(ctlr->ntd*sizeof(Block*));
+		ctlr->rb = malloc(ctlr->nrd*sizeof(Block*));
+		ctlr->td = mallocalign(sizeof(D)*ctlr->ntd, 256, 0, 0);
+		ctlr->rd = mallocalign(sizeof(D)*ctlr->nrd, 256, 0, 0);
 		ctlr->dtcc = mallocalign(sizeof(Dtcc), 64, 0, 0);
-
+		if(ctlr->rb == nil || ctlr->rb == nil || 
+		   ctlr->rd == nil || ctlr->rd == nil || ctlr->dtcc == nil){
+			free(ctlr->tb);
+			ctlr->tb = nil;
+			free(ctlr->rb);
+			ctlr->rb = nil;
+			free(ctlr->td);
+			ctlr->td = nil;
+			free(ctlr->rd);
+			ctlr->rd = nil;
+			free(ctlr->dtcc);
+			ctlr->dtcc = nil;
+			qlock(&ctlr->alock);
+			error(Enomem);
+		}
+		ctlr->init = 1;
 		kproc("rtl8169", rtl8169reseter, edev);
 		qlock(&ctlr->alock);
 	}
@@ -1034,6 +1049,11 @@ rtl8169pci(void)
 			continue;
 		}
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("rtl8169: can't allocate memory\n");
+			iofree(port);
+			continue;
+		}
 		ctlr->port = port;
 		ctlr->pcidev = p;
 		ctlr->pciv = i;
diff --git a/sys/src/9/pc/ether82543gc.c b/sys/src/9/pc/ether82543gc.c
index c764d0bcf..8c6b56610 100644
--- a/sys/src/9/pc/ether82543gc.c
+++ b/sys/src/9/pc/ether82543gc.c
@@ -1265,9 +1265,15 @@ gc82543pci(void)
 			break;
 		}
 
+		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("82543gc: can't allocate memory\n");
+			continue;
+		}
 		mem = vmap(p->mem[0].bar & ~0x0F, p->mem[0].size);
 		if(mem == 0){
-			print("gc82543: can't map %8.8luX\n", p->mem[0].bar);
+			print("82543gc: can't map %8.8luX\n", p->mem[0].bar);
+			free(ctlr);
 			continue;
 		}
 		cls = pcicfgr8(p, PciCLS);
@@ -1275,6 +1281,7 @@ gc82543pci(void)
 			case 0x00:
 			case 0xFF:
 				print("82543gc: unusable cache line size\n");
+				free(ctlr);
 				continue;
 			case 0x08:
 				break;
@@ -1282,7 +1289,6 @@ gc82543pci(void)
 				print("82543gc: cache line size %d, expected 32\n",
 					cls*4);
 		}
-		ctlr = malloc(sizeof(Ctlr));
 		ctlr->port = p->mem[0].bar & ~0x0F;
 		ctlr->pcidev = p;
 		ctlr->id = (p->did<<16)|p->vid;
diff --git a/sys/src/9/pc/ether82557.c b/sys/src/9/pc/ether82557.c
index 6fbb12a72..8f5c9ebf1 100644
--- a/sys/src/9/pc/ether82557.c
+++ b/sys/src/9/pc/ether82557.c
@@ -795,6 +795,8 @@ ctlrinit(Ctlr* ctlr)
 	 */
 	ilock(&ctlr->cblock);
 	ctlr->cbr = malloc(ctlr->ncb*sizeof(Cb));
+	if(ctlr->cbr == nil)
+		panic("i82557: can't allocate cbr");
 	for(i = 0; i < ctlr->ncb; i++){
 		ctlr->cbr[i].status = CbC|CbOK;
 		ctlr->cbr[i].command = CbS|CbNOP;
@@ -911,6 +913,8 @@ reread:
 	if(ctlr->eepromsz == 0){
 		ctlr->eepromsz = 8-size;
 		ctlr->eeprom = malloc((1<<ctlr->eepromsz)*sizeof(ushort));
+		if(ctlr->eeprom == nil)
+			panic("i82557: can't allocate eeprom");
 		goto reread;
 	}
 
@@ -971,6 +975,11 @@ i82557pci(void)
 		}
 
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("i82557: can't allocate memory\n");
+			iofree(port);
+			continue;
+		}
 		ctlr->port = port;
 		ctlr->pcidev = p;
 		ctlr->nop = nop;
diff --git a/sys/src/9/pc/ether82563.c b/sys/src/9/pc/ether82563.c
index 34fa9809d..ba0140d4a 100644
--- a/sys/src/9/pc/ether82563.c
+++ b/sys/src/9/pc/ether82563.c
@@ -1458,16 +1458,21 @@ i82563attach(Ether *edev)
 	ctlr->nrd = Nrd;
 	ctlr->ntd = Ntd;
 	ctlr->alloc = malloc(ctlr->nrd*sizeof(Rd)+ctlr->ntd*sizeof(Td) + 255);
-	if(ctlr->alloc == nil){
+	ctlr->rb = malloc(ctlr->nrd * sizeof(Block*));
+	ctlr->tb = malloc(ctlr->ntd * sizeof(Block*));
+	if(ctlr->alloc == nil || ctlr->rb == nil || ctlr->tb == nil){
+		free(ctlr->rb);
+		ctlr->rb = nil;
+		free(ctlr->tb);
+		ctlr->tb = nil;
+		free(ctlr->alloc);
+		ctlr->alloc = nil;
 		qunlock(&ctlr->alock);
 		error(Enomem);
 	}
 	ctlr->rdba = (Rd*)ROUNDUP((uintptr)ctlr->alloc, 256);
 	ctlr->tdba = (Td*)(ctlr->rdba + ctlr->nrd);
 
-	ctlr->rb = malloc(ctlr->nrd * sizeof(Block*));
-	ctlr->tb = malloc(ctlr->ntd * sizeof(Block*));
-
 	if(waserror()){
 		while(bp = i82563rballoc(rbtab + ctlr->pool)){
 			bp->free = nil;
@@ -1943,6 +1948,10 @@ i82563pci(void)
 		if((type = didtype(p->did)) == -1)
 			continue;
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("%s: can't allocate memory\n", cttab[type].name);
+			continue;
+		}
 		ctlr->type = type;
 		ctlr->pcidev = p;
 		ctlr->rbsz = cttab[type].mtu;
diff --git a/sys/src/9/pc/ether82598.c b/sys/src/9/pc/ether82598.c
index 6c72474e0..393982c16 100644
--- a/sys/src/9/pc/ether82598.c
+++ b/sys/src/9/pc/ether82598.c
@@ -909,10 +909,16 @@ scan(void)
 			print("i82598: too many controllers\n");
 			return;
 		}
+		c = malloc(sizeof *c);
+		if(c == nil){
+			print("i82598: can't allocate memory\n");
+			continue;
+		}
 		io = p->mem[0].bar & ~0xf;
 		mem = vmap(io, p->mem[0].size);
 		if(mem == nil){
 			print("i82598: can't map %#p\n", p->mem[0].bar);
+			free(c);
 			continue;
 		}
 		io3 = p->mem[3].bar & ~0xf;
@@ -920,9 +926,9 @@ scan(void)
 		if(mem3 == nil){
 			print("i82598: can't map %#p\n", p->mem[3].bar);
 			vunmap(mem, p->mem[0].size);
+			free(c);
 			continue;
 		}
-		c = malloc(sizeof *c);
 		c->p = p;
 		c->reg = (u32int*)mem;
 		c->reg3 = (u32int*)mem3;
diff --git a/sys/src/9/pc/ether83815.c b/sys/src/9/pc/ether83815.c
index 19131b0f6..597e34394 100644
--- a/sys/src/9/pc/ether83815.c
+++ b/sys/src/9/pc/ether83815.c
@@ -1068,6 +1068,10 @@ scanpci83815(void)
 		 * bar[1] is the memory-mapped register address.
 		 */
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("ns83815: can't allocate memory\n");
+			continue;
+		}
 		ctlr->port = p->mem[0].bar & ~0x01;
 		ctlr->pcidev = p;
 		ctlr->id = id;
diff --git a/sys/src/9/pc/etherbcm.c b/sys/src/9/pc/etherbcm.c
index afe9d8e44..7537ec5f6 100644
--- a/sys/src/9/pc/etherbcm.c
+++ b/sys/src/9/pc/etherbcm.c
@@ -791,6 +791,12 @@ bcmpci(void)
 			print("bcm: unable to alloc Ctlr\n");
 			continue;
 		}
+		ctlr->sends = malloc(sizeof(ctlr->sends[0]) * SendRingLen);
+		if(ctlr->sends == nil){
+			print("bcm: unable to alloc ctlr->sends\n");
+			free(ctlr);
+			continue;
+		}
 		mem = vmap(pdev->mem[0].bar & ~0x0F, pdev->mem[0].size);
 		if(mem == nil) {
 			print("bcm: can't map %8.8luX\n", pdev->mem[0].bar);
@@ -804,7 +810,6 @@ bcmpci(void)
 		ctlr->recvprod = xspanalloc(32 * RecvProdRingLen, 16, 0);
 		ctlr->recvret = xspanalloc(32 * RecvRetRingLen, 16, 0);
 		ctlr->sendr = xspanalloc(16 * SendRingLen, 16, 0);
-		ctlr->sends = malloc(sizeof(Block) * SendRingLen);
 		if(bcmhead != nil)
 			bcmtail->link = ctlr;
 		else
diff --git a/sys/src/9/pc/etherdp83820.c b/sys/src/9/pc/etherdp83820.c
index 29b1bbfa9..78bd3b477 100644
--- a/sys/src/9/pc/etherdp83820.c
+++ b/sys/src/9/pc/etherdp83820.c
@@ -1165,6 +1165,10 @@ dp83820pci(void)
 		}
 
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("DP83820: can't allocate memory\n");
+			continue;
+		}
 		ctlr->port = p->mem[1].bar & ~0x0F;
 		ctlr->pcidev = p;
 		ctlr->id = (p->did<<16)|p->vid;
diff --git a/sys/src/9/pc/etherec2t.c b/sys/src/9/pc/etherec2t.c
index 4359e399b..1a9a34ed2 100644
--- a/sys/src/9/pc/etherec2t.c
+++ b/sys/src/9/pc/etherec2t.c
@@ -84,13 +84,13 @@ reset(Ether* ether)
 				ec2t->iochecksum = 1;
 		}
 	}
-	if(slot < 0){
+	ctlr = malloc(sizeof(Dp8390));
+	if(ctlr == nil || slot < 0){
 		iofree(port);
+		free(ctlr);
 		return -1;
 	}
-
-	ether->ctlr = malloc(sizeof(Dp8390));
-	ctlr = ether->ctlr;
+	ether->ctlr = ctlr;
 	ctlr->width = 2;
 	ctlr->ram = 0;
 
diff --git a/sys/src/9/pc/etherelnk3.c b/sys/src/9/pc/etherelnk3.c
index c0a109453..45175d86a 100644
--- a/sys/src/9/pc/etherelnk3.c
+++ b/sys/src/9/pc/etherelnk3.c
@@ -446,6 +446,8 @@ init905(Ctlr* ctlr)
 	 *	make sure each entry is 8-byte aligned.
 	 */
 	ctlr->upbase = malloc((ctlr->nup+1)*sizeof(Pd));
+	if(ctlr->upbase == nil)
+		panic("etherlnk3: can't allocate upr");
 	ctlr->upr = (Pd*)ROUNDUP((ulong)ctlr->upbase, 8);
 
 	prev = ctlr->upr;
@@ -454,7 +456,7 @@ init905(Ctlr* ctlr)
 		pd->control = 0;
 		bp = iallocb(sizeof(Etherpkt));
 		if(bp == nil)
-			panic("can't allocate ethernet receive ring");
+			panic("etherlnk3: iallocb: out of memory");
 		pd->addr = PADDR(bp->rp);
 		pd->len = updnLastFrag|sizeof(Etherpkt);
 
@@ -465,6 +467,8 @@ init905(Ctlr* ctlr)
 	ctlr->uphead = ctlr->upr;
 
 	ctlr->dnbase = malloc((ctlr->ndn+1)*sizeof(Pd));
+	if(ctlr->dnbase == nil)
+		panic("etherlnk3: can't allocate dnr");
 	ctlr->dnr = (Pd*)ROUNDUP((ulong)ctlr->dnbase, 8);
 
 	prev = ctlr->dnr;
@@ -1243,6 +1247,10 @@ tcmadapter(int port, int irq, Pcidev* pcidev)
 	Ctlr *ctlr;
 
 	ctlr = malloc(sizeof(Ctlr));
+	if(ctlr == nil){
+		print("etherelnk3: can't allocate memory\n");
+		return nil;
+	}
 	ctlr->port = port;
 	ctlr->irq = irq;
 	ctlr->pcidev = pcidev;
@@ -1480,6 +1488,8 @@ tcm59Xpci(void)
 		COMMAND(port, AcknowledgeInterrupt, 0xFF);
 
 		ctlr = tcmadapter(port, irq, p);
+		if(ctlr == nil)
+			continue;
 		switch(p->did){
 		default:
 			break;
@@ -1517,8 +1527,8 @@ tcm5XXpcmcia(Ether* ether)
 	for(i = 0; tcmpcmcia[i] != nil; i++){
 		if(cistrcmp(ether->type, tcmpcmcia[i]))
 			continue;
-		ctlr = tcmadapter(ether->port, ether->irq, nil);
-		ctlr->active = 1;
+		if(ctlr = tcmadapter(ether->port, ether->irq, nil))
+			ctlr->active = 1;
 		return ctlr;
 	}
 
@@ -2087,14 +2097,14 @@ etherelnk3reset(Ether* ether)
 		else {
 			ctlr->rbp = rbpalloc(iallocb);
 			if(ctlr->rbp == nil)
-				panic("can't reset ethernet: out of memory");
+				panic("etherlnk3: iallocb: out of memory");
 		}
 		outl(port+TxFreeThresh, HOWMANY(ETHERMAXTU, 256));
 		break;
 	default:
 		ctlr->rbp = rbpalloc(iallocb);
 		if(ctlr->rbp == nil)
-			panic("can't reset ethernet: out of memory");
+			panic("etherlnk3: iallocb: out of memory");
 		break;
 	}
 
diff --git a/sys/src/9/pc/etherm10g.c b/sys/src/9/pc/etherm10g.c
index f759c99c0..a3bde6031 100644
--- a/sys/src/9/pc/etherm10g.c
+++ b/sys/src/9/pc/etherm10g.c
@@ -1564,8 +1564,10 @@ m10gpci(void)
 			continue;
 		}
 		c = malloc(sizeof *c);
-		if(c == nil)
+		if(c == nil){
+			print("etherm10g: can't allocate memory\n");
 			continue;
+		}
 		c->pcidev = p;
 		c->id = p->did<<16 | p->vid;
 		c->boot = pcicap(p, PciCapVND);
diff --git a/sys/src/9/pc/ethersmc.c b/sys/src/9/pc/ethersmc.c
index 1c2ac8025..64dcd0075 100644
--- a/sys/src/9/pc/ethersmc.c
+++ b/sys/src/9/pc/ethersmc.c
@@ -708,13 +708,14 @@ reset(Ether* ether)
 		return -1;
 	}
 
-	ether->ctlr = malloc(sizeof(Smc91xx));
-	ctlr = ether->ctlr;
+	ctlr = malloc(sizeof(Smc91xx));
 	if (ctlr == 0) {
+		print("smc: can't allocate memory\n");
 		iofree(ether->port);
 		pcmspecialclose(slot);
 		return -1;
 	}
+	ether->ctlr = ctlr;
 
 	ilock(ctlr);
 	ctlr->rev = 0;
diff --git a/sys/src/9/pc/ethervgbe.c b/sys/src/9/pc/ethervgbe.c
index da2bd023f..3a1c4d3c1 100644
--- a/sys/src/9/pc/ethervgbe.c
+++ b/sys/src/9/pc/ethervgbe.c
@@ -759,16 +759,21 @@ vgbeattach(Ether* edev)
 		return;
 	}
 
-//	print("vgbe: attach\n");
-
-	/* Allocate Rx ring.  (TODO: Alignment ?) */
+	/* Allocate Rx/Tx ring.  (TODO: Alignment ?) */
 	rxdesc = mallocalign(RxCount* sizeof(RxDesc), 256, 0, 0);
-	if(rxdesc == nil){
+	if(rxdesc == nil)
 		print("vgbe: unable to alloc Rx ring\n");
+	txdesc = mallocalign(TxCount* sizeof(TxDesc), 256, 0, 0);
+	if(txdesc == nil)
+		print("vgbe: unable to alloc Tx ring\n");
+	if(rxdesc == nil || txdesc == nil){
+		free(rxdesc);
+		free(txdesc);
 		unlock(&ctlr->init_lock);
-		return;
+		error(Enomem);
 	}
 	ctlr->rx_ring = rxdesc;
+	ctlr->tx_ring = txdesc;
 
 	/* Allocate Rx blocks, initialize Rx ring. */
 	for(i = 0; i < RxCount; i++)
@@ -785,15 +790,6 @@ vgbeattach(Ether* edev)
 	wiow(ctlr, RxDscIdx, 0);
 	wiow(ctlr, RxResCnt, RxCount);
 
-	/* Allocate Tx ring. */
-	txdesc = mallocalign(TxCount* sizeof(TxDesc), 256, 0, 0);
-	if(txdesc == nil){
-		print("vgbe: unable to alloc Tx ring\n");
-		unlock(&ctlr->init_lock);
-		return;
-	}
-	ctlr->tx_ring = txdesc;
-
 	/* Init DMAs */
 	wiob(ctlr, DmaCfg0, 4);
 
diff --git a/sys/src/9/pc/ethervt6102.c b/sys/src/9/pc/ethervt6102.c
index 32d17afae..60fa6b120 100644
--- a/sys/src/9/pc/ethervt6102.c
+++ b/sys/src/9/pc/ethervt6102.c
@@ -491,7 +491,7 @@ vt6102attach(Ether* edev)
 	alloc = malloc((ctlr->nrd+ctlr->ntd)*ctlr->cls + ctlr->ntd*Txcopy + ctlr->cls-1);
 	if(alloc == nil){
 		qunlock(&ctlr->alock);
-		return;
+		error(Enomem);
 	}
 	ctlr->alloc = alloc;
 	alloc = (uchar*)ROUNDUP((ulong)alloc, ctlr->cls);
@@ -967,6 +967,11 @@ vt6102pci(void)
 			continue;
 		}
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("vt6102: can't allocate memory\n");
+			iofree(port);
+			continue;
+		}
 		ctlr->port = port;
 		ctlr->pcidev = p;
 		ctlr->id = (p->did<<16)|p->vid;
diff --git a/sys/src/9/pc/ethervt6105m.c b/sys/src/9/pc/ethervt6105m.c
index 06d02c0f2..e91c7241a 100644
--- a/sys/src/9/pc/ethervt6105m.c
+++ b/sys/src/9/pc/ethervt6105m.c
@@ -439,9 +439,8 @@ vt6105Mifstat(Ether* edev, void* a, long n, ulong offset)
 	char *alloc, *e, *p;
 
 	ctlr = edev->ctlr;
-
-	alloc = malloc(READSTR);
-	p = alloc;
+	
+	p = alloc = smalloc(READSTR);
 	e = p + READSTR;
 	for(i = 0; i < Nrxstats; i++){
 		p = seprint(p, e, "%s: %ud\n", rxstats[i], ctlr->rxstats[i]);
@@ -635,7 +634,7 @@ vt6105Mattach(Ether* edev)
 	alloc = mallocalign((ctlr->nrd+ctlr->ntd)*dsz, dsz, 0, 0);
 	if(alloc == nil){
 		qunlock(&ctlr->alock);
-		return;
+		error(Enomem);
 	}
 	ctlr->alloc = alloc;
 
@@ -1132,6 +1131,11 @@ vt6105Mpci(void)
 			continue;
 		}
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("vt6105M: can't allocate memory\n");
+			iofree(port);
+			continue;
+		}
 		ctlr->port = port;
 		ctlr->pcidev = p;
 		ctlr->id = (p->did<<16)|p->vid;
diff --git a/sys/src/9/pc/etherwavelan.c b/sys/src/9/pc/etherwavelan.c
index e76905b52..4aa0c80eb 100644
--- a/sys/src/9/pc/etherwavelan.c
+++ b/sys/src/9/pc/etherwavelan.c
@@ -117,6 +117,10 @@ wavelanpciscan(void)
 		}
 
 		ctlr = malloc(sizeof(Ctlr));
+		if(ctlr == nil){
+			print("wavelanpci: can't allocate memory\n");
+			continue;
+		}
 		ctlr->pcidev = p;
 		mem = vmap(p->mem[0].bar&~0xF, p->mem[0].size);
 		if(mem == nil){
diff --git a/sys/src/9/pc/pci.c b/sys/src/9/pc/pci.c
index 9d28bc1de..decad75ba 100644
--- a/sys/src/9/pc/pci.c
+++ b/sys/src/9/pc/pci.c
@@ -200,6 +200,8 @@ pcibusmap(Pcidev *root, ulong *pmema, ulong *pioa, int wrreg)
 
 	ntb *= (PciCIS-PciBAR0)/4;
 	table = malloc(2*ntb*sizeof(Pcisiz));
+	if(table == nil)
+		panic("pcibusmap: can't allocate memory");
 	itb = table;
 	mtb = table+ntb;
 
@@ -389,6 +391,8 @@ pcilscan(int bno, Pcidev** list)
 			if(l == 0xFFFFFFFF || l == 0)
 				continue;
 			p = malloc(sizeof(*p));
+			if(p == nil)
+				panic("pcilscan: can't allocate memory");
 			p->tbdf = tbdf;
 			p->vid = l;
 			p->did = l>>16;
diff --git a/sys/src/9/pc/sdide.c b/sys/src/9/pc/sdide.c
index ca489525c..fb6147ca0 100644
--- a/sys/src/9/pc/sdide.c
+++ b/sys/src/9/pc/sdide.c
@@ -393,7 +393,7 @@ atadumpstate(Drive* drive, SDreq *r, uvlong lba, int count)
 		prd = ctlr->prdt;
 		print("bmicx %2.2uX bmisx %2.2uX prdt %8.8p\n",
 			inb(bmiba+Bmicx), inb(bmiba+Bmisx), prd);
-		for(;;){
+		while(prd){
 			print("pa 0x%8.8luX count %8.8uX\n",
 				prd->pa, prd->count);
 			if(prd->count & PrdEOT)
@@ -2392,6 +2392,7 @@ atadisable(SDev *sdev)
 		if (ctlr->pcidev)
 			pciclrbme(ctlr->pcidev);
 		free(ctlr->prdt);
+		ctlr->prdt = nil;
 	}
 	return 0;
 }
diff --git a/sys/src/9/pc/uartaxp.c b/sys/src/9/pc/uartaxp.c
index 53551502d..a244be278 100644
--- a/sys/src/9/pc/uartaxp.c
+++ b/sys/src/9/pc/uartaxp.c
@@ -763,6 +763,10 @@ axpalloc(int ctlrno, Pcidev* pcidev)
 	int i, n, timeo;
 
 	ctlr = malloc(sizeof(Ctlr));
+	if(ctlr == nil){
+		print("uartaxp: can't allocate memory\n");
+		return nil;
+	}
 	seprint(name, name+sizeof(name), "uartaxp%d", ctlrno);
 	kstrdup(&ctlr->name, name);
 	ctlr->pcidev = pcidev;
diff --git a/sys/src/9/pc/uartisa.c b/sys/src/9/pc/uartisa.c
index 7252813bf..f02080d70 100644
--- a/sys/src/9/pc/uartisa.c
+++ b/sys/src/9/pc/uartisa.c
@@ -27,7 +27,7 @@ uartisa(int ctlrno, ISAConf* isa)
 
 	uart = malloc(sizeof(Uart));
 	ctlr = i8250alloc(io, isa->irq, BUSUNKNOWN);
-	if(ctlr == nil){
+	if(uart == nil || ctlr == nil){
 		iofree(io);
 		free(uart);
 		return nil;