Module Name: src
Committed By: maxv
Date: Sun Sep 15 09:24:39 UTC 2019
Modified Files:
src/sys/dev/usb: usb_subr.c
Log Message:
Reset ud_pipe0 to NULL before calling usbd_setup_pipe_flags(). If the call
fails we call usbd_remove_device(), which tries to free ud_pipe0, but it
was already freed.
While here, add two sanity checks, to prevent possible surprises.
To generate a diff of this commit:
cvs rdiff -u -r1.239 -r1.240 src/sys/dev/usb/usb_subr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/usb_subr.c
diff -u src/sys/dev/usb/usb_subr.c:1.239 src/sys/dev/usb/usb_subr.c:1.240
--- src/sys/dev/usb/usb_subr.c:1.239 Wed Aug 28 01:44:39 2019
+++ src/sys/dev/usb/usb_subr.c Sun Sep 15 09:24:38 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: usb_subr.c,v 1.239 2019/08/28 01:44:39 mrg Exp $ */
+/* $NetBSD: usb_subr.c,v 1.240 2019/09/15 09:24:38 maxv Exp $ */
/* $FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $ */
/*
@@ -32,7 +32,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.239 2019/08/28 01:44:39 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.240 2019/09/15 09:24:38 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_compat_netbsd.h"
@@ -1353,6 +1353,7 @@ usbd_new_device(device_t parent, struct
/* Re-establish the default pipe with the new MPS. */
usbd_kill_pipe(dev->ud_pipe0);
+ dev->ud_pipe0 = NULL;
err = usbd_setup_pipe_flags(dev, 0, &dev->ud_ep0, USBD_DEFAULT_INTERVAL,
&dev->ud_pipe0, USBD_MPSAFE);
if (err) {
@@ -1378,6 +1379,7 @@ usbd_new_device(device_t parent, struct
/* Re-establish the default pipe with the new address. */
usbd_kill_pipe(dev->ud_pipe0);
+ dev->ud_pipe0 = NULL;
err = usbd_setup_pipe_flags(dev, 0, &dev->ud_ep0, USBD_DEFAULT_INTERVAL,
&dev->ud_pipe0, USBD_MPSAFE);
if (err) {
@@ -1431,6 +1433,10 @@ usbd_reload_device_desc(struct usbd_devi
err = usbd_get_device_desc(dev, udd);
if (err)
return err;
+ if (udd->bDescriptorType != UDESC_DEVICE)
+ return USBD_INVAL;
+ if (udd->bLength < USB_DEVICE_DESCRIPTOR_SIZE)
+ return USBD_INVAL;
DPRINTFN(15, "bLength %5ju", udd->bLength, 0, 0, 0);
DPRINTFN(15, "bDescriptorType %5ju", udd->bDescriptorType, 0, 0, 0);
