Module Name: src
Committed By: riastradh
Date: Sat Jun 12 12:11:28 UTC 2021
Modified Files:
src/sys/dev/usb: usb_subr.c
Log Message:
usb(4): Verify dev->ud_subdevs is still there before freeing it.
usbd_attachinterfaces may sleep, and if it does, it releases the
kernel lock, in which case another thread may free dev->ud_subdevs.
To generate a diff of this commit:
cvs rdiff -u -r1.251 -r1.252 src/sys/dev/usb/usb_subr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/usb_subr.c
diff -u src/sys/dev/usb/usb_subr.c:1.251 src/sys/dev/usb/usb_subr.c:1.252
--- src/sys/dev/usb/usb_subr.c:1.251 Sat Jun 12 12:11:11 2021
+++ src/sys/dev/usb/usb_subr.c Sat Jun 12 12:11:27 2021
@@ -1,4 +1,4 @@
-/* $NetBSD: usb_subr.c,v 1.251 2021/06/12 12:11:11 riastradh Exp $ */
+/* $NetBSD: usb_subr.c,v 1.252 2021/06/12 12:11:27 riastradh Exp $ */
/* $FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $ */
/*
@@ -32,7 +32,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.251 2021/06/12 12:11:11 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.252 2021/06/12 12:11:27 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_compat_netbsd.h"
@@ -1072,7 +1072,7 @@ usbd_probe_and_attach(device_t parent, s
err = usbd_attachinterfaces(parent, dev, port, NULL);
- if (!dev->ud_nifaces_claimed) {
+ if (dev->ud_subdevs && dev->ud_nifaces_claimed == 0) {
kmem_free(dev->ud_subdevs,
dev->ud_subdevlen * sizeof(device_t));
dev->ud_subdevs = 0;
