Module Name: src
Committed By: maxv
Date: Sat Sep 14 12:48:51 UTC 2019
Modified Files:
src/sys/dev/usb: ugensa.c
Log Message:
Fix error handling, to prevent kernel crashes when detaching an ugensa0
device. Also move usbd_add_drv_event() down, after we are sure the attach
didn't fail.
Found with vHCI.
To generate a diff of this commit:
cvs rdiff -u -r1.39 -r1.40 src/sys/dev/usb/ugensa.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/ugensa.c
diff -u src/sys/dev/usb/ugensa.c:1.39 src/sys/dev/usb/ugensa.c:1.40
--- src/sys/dev/usb/ugensa.c:1.39 Thu May 9 02:43:35 2019
+++ src/sys/dev/usb/ugensa.c Sat Sep 14 12:48:51 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: ugensa.c,v 1.39 2019/05/09 02:43:35 mrg Exp $ */
+/* $NetBSD: ugensa.c,v 1.40 2019/09/14 12:48:51 maxv Exp $ */
/*
* Copyright (c) 2004, 2005 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ugensa.c,v 1.39 2019/05/09 02:43:35 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ugensa.c,v 1.40 2019/09/14 12:48:51 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -62,6 +62,12 @@ int ugensadebug = 0;
struct ugensa_softc {
device_t sc_dev; /* base device */
+
+ enum {
+ UGENSA_INIT_NONE,
+ UGENSA_INIT_INITED
+ } sc_init_state;
+
struct usbd_device * sc_udev; /* device */
struct usbd_interface * sc_iface; /* interface */
@@ -144,6 +150,7 @@ ugensa_attach(device_t parent, device_t
sc->sc_dev = self;
sc->sc_dying = false;
+ sc->sc_init_state = UGENSA_INIT_NONE;
aprint_naive("\n");
aprint_normal("\n");
@@ -187,8 +194,6 @@ ugensa_attach(device_t parent, device_t
ucaa.ucaa_methods = &ugensa_methods;
ucaa.ucaa_arg = sc;
- usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev);
-
ucaa.ucaa_bulkin = ucaa.ucaa_bulkout = -1;
for (i = 0; i < id->bNumEndpoints; i++) {
int addr, dir, attr;
@@ -227,6 +232,9 @@ ugensa_attach(device_t parent, device_t
goto bad;
}
+ sc->sc_init_state = UGENSA_INIT_INITED;
+ usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev);
+
DPRINTF(("ugensa: in=0x%x out=0x%x\n", ucaa.ucaa_bulkin,
ucaa.ucaa_bulkout));
sc->sc_subdev = config_found_sm_loc(self, "ucombus", NULL, &ucaa,
@@ -261,6 +269,9 @@ ugensa_detach(device_t self, int flags)
sc->sc_dying = true;
+ if (sc->sc_init_state < UGENSA_INIT_INITED)
+ return 0;
+
if (sc->sc_subdev != NULL) {
rv = config_detach(sc->sc_subdev, flags);
sc->sc_subdev = NULL;
