summaryrefslogtreecommitdiff
path: root/sys/dev
diff options
context:
space:
mode:
authorriastradh <riastradh@NetBSD.org>2022-08-07 11:25:32 +0000
committerriastradh <riastradh@NetBSD.org>2022-08-07 11:25:32 +0000
commit18706df55dd2f58c64a69ff61a72f69c32f293d7 (patch)
tree5ac66d50dbf6761570e48bfaa083014075f54440 /sys/dev
parenta4f95a9c3db799b8a11dd5b922a217fa3f6d5b3c (diff)
uirda(4): Unconditionally initializes mutexes and selq on attach.
We're going to unconditionally destroy them on detach. Reported-by: syzbot+6b8aea3a51d8b1e5ab61@syzkaller.appspotmail.com https://syzkaller.appspot.com/bug?id=ec5ed628986cba5aab5705691596a2d27b0301fc
Diffstat (limited to 'sys/dev')
-rw-r--r--sys/dev/usb/uirda.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/sys/dev/usb/uirda.c b/sys/dev/usb/uirda.c
index c25fa54bbdc..f566772cb28 100644
--- a/sys/dev/usb/uirda.c
+++ b/sys/dev/usb/uirda.c
@@ -1,4 +1,4 @@
-/* $NetBSD: uirda.c,v 1.52 2021/09/26 15:08:29 thorpej Exp $ */
+/* $NetBSD: uirda.c,v 1.53 2022/08/07 11:25:32 riastradh Exp $ */
/*
* Copyright (c) 2001 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uirda.c,v 1.52 2021/09/26 15:08:29 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uirda.c,v 1.53 2022/08/07 11:25:32 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -201,6 +201,10 @@ uirda_attach(device_t parent, device_t self, void *aux)
sc->sc_udev = dev;
sc->sc_iface = iface;
+ mutex_init(&sc->sc_wr_buf_lk, MUTEX_DEFAULT, IPL_NONE);
+ mutex_init(&sc->sc_rd_buf_lk, MUTEX_DEFAULT, IPL_NONE);
+ selinit(&sc->sc_rd_sel);
+
if (sc->sc_hdszi == 0)
sc->sc_hdszi = UIRDA_INPUT_HEADER_SIZE;
@@ -280,10 +284,6 @@ uirda_attach(device_t parent, device_t self, void *aux)
usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev);
- mutex_init(&sc->sc_wr_buf_lk, MUTEX_DEFAULT, IPL_NONE);
- mutex_init(&sc->sc_rd_buf_lk, MUTEX_DEFAULT, IPL_NONE);
- selinit(&sc->sc_rd_sel);
-
ia.ia_type = IR_TYPE_IRFRAME;
ia.ia_methods = sc->sc_irm ? sc->sc_irm : &uirda_methods;
ia.ia_handle = sc;