diff options
| author | riastradh <riastradh@NetBSD.org> | 2021-06-12 12:11:27 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2021-06-12 12:11:27 +0000 |
| commit | 9553d1191f0ed209b8f2109ec4e355aee3bce1f9 (patch) | |
| tree | 419d538edbc967ac51232960e89e9671f98fe42d /sys/dev | |
| parent | 34b8996a9f30cce4e662f66978bc1715ef8c20c4 (diff) | |
usb(4): Verify dev->ud_subdevs is still there before freeing it.
usbd_attachinterfaces may sleep, and if it does, it releases the
kernel lock, in which case another thread may free dev->ud_subdevs.
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/usb/usb_subr.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/dev/usb/usb_subr.c b/sys/dev/usb/usb_subr.c index a36ae1d633b..d1ef59948c3 100644 --- a/sys/dev/usb/usb_subr.c +++ b/sys/dev/usb/usb_subr.c @@ -1,4 +1,4 @@ -/* $NetBSD: usb_subr.c,v 1.251 2021/06/12 12:11:11 riastradh Exp $ */ +/* $NetBSD: usb_subr.c,v 1.252 2021/06/12 12:11:27 riastradh Exp $ */ /* $FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $ */ /* @@ -32,7 +32,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.251 2021/06/12 12:11:11 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.252 2021/06/12 12:11:27 riastradh Exp $"); #ifdef _KERNEL_OPT #include "opt_compat_netbsd.h" @@ -1072,7 +1072,7 @@ usbd_probe_and_attach(device_t parent, struct usbd_device *dev, err = usbd_attachinterfaces(parent, dev, port, NULL); - if (!dev->ud_nifaces_claimed) { + if (dev->ud_subdevs && dev->ud_nifaces_claimed == 0) { kmem_free(dev->ud_subdevs, dev->ud_subdevlen * sizeof(device_t)); dev->ud_subdevs = 0; |
