Sat Sep 26 19:00:35 2009 UTC ()
Pull up following revision(s) (requested by pooka in ticket #1017):
	sys/dev/usb/ugen.c: revision 1.104
ugen_get_cdesc() can return NULL.  When this happens, return the
karmic EINVAL error instead of crashing.


(snj)
diff -r1.99.8.1 -r1.99.8.2 src/sys/dev/usb/ugen.c
cvs diff -r1.99.8.1 -r1.99.8.2 src/sys/dev/usb/ugen.c (expand / switch to unified diff)

--- src/sys/dev/usb/ugen.c 2009/03/24 20:59:29 1.99.8.1
+++ src/sys/dev/usb/ugen.c 2009/09/26 19:00:35 1.99.8.2
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: ugen.c,v 1.99.8.1 2009/03/24 20:59:29 snj Exp $ */ 1/* $NetBSD: ugen.c,v 1.99.8.2 2009/09/26 19:00:35 snj Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 1998, 2004 The NetBSD Foundation, Inc. 4 * Copyright (c) 1998, 2004 The NetBSD Foundation, Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * This code is derived from software contributed to The NetBSD Foundation 7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Lennart Augustsson (lennart@augustsson.net) at 8 * by Lennart Augustsson (lennart@augustsson.net) at
9 * Carlstedt Research & Technology. 9 * Carlstedt Research & Technology.
10 * 10 *
11 * Copyright (c) 2006 BBN Technologies Corp. All rights reserved. 11 * Copyright (c) 2006 BBN Technologies Corp. All rights reserved.
12 * Effort sponsored in part by the Defense Advanced Research Projects 12 * Effort sponsored in part by the Defense Advanced Research Projects
13 * Agency (DARPA) and the Department of the Interior National Business 13 * Agency (DARPA) and the Department of the Interior National Business
14 * Center under agreement number NBCHC050166. 14 * Center under agreement number NBCHC050166.
@@ -27,27 +27,27 @@ @@ -27,27 +27,27 @@
27 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 27 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
29 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 29 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 32 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 33 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 34 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE. 35 * POSSIBILITY OF SUCH DAMAGE.
36 */ 36 */
37 37
38 38
39#include <sys/cdefs.h> 39#include <sys/cdefs.h>
40__KERNEL_RCSID(0, "$NetBSD: ugen.c,v 1.99.8.1 2009/03/24 20:59:29 snj Exp $"); 40__KERNEL_RCSID(0, "$NetBSD: ugen.c,v 1.99.8.2 2009/09/26 19:00:35 snj Exp $");
41 41
42#include "opt_ugen_bulk_ra_wb.h" 42#include "opt_ugen_bulk_ra_wb.h"
43#include "opt_compat_netbsd.h" 43#include "opt_compat_netbsd.h"
44 44
45#include <sys/param.h> 45#include <sys/param.h>
46#include <sys/systm.h> 46#include <sys/systm.h>
47#include <sys/kernel.h> 47#include <sys/kernel.h>
48#include <sys/malloc.h> 48#include <sys/malloc.h>
49#if defined(__NetBSD__) || defined(__OpenBSD__) 49#if defined(__NetBSD__) || defined(__OpenBSD__)
50#include <sys/device.h> 50#include <sys/device.h>
51#include <sys/ioctl.h> 51#include <sys/ioctl.h>
52#elif defined(__FreeBSD__) 52#elif defined(__FreeBSD__)
53#include <sys/module.h> 53#include <sys/module.h>
@@ -1724,26 +1724,28 @@ ugen_do_ioctl(struct ugen_softc *sc, int @@ -1724,26 +1724,28 @@ ugen_do_ioctl(struct ugen_softc *sc, int
1724 } 1724 }
1725 ed->ued_desc = *edesc; 1725 ed->ued_desc = *edesc;
1726 free(cdesc, M_TEMP); 1726 free(cdesc, M_TEMP);
1727 break; 1727 break;
1728 case USB_GET_FULL_DESC: 1728 case USB_GET_FULL_DESC:
1729 { 1729 {
1730 int len; 1730 int len;
1731 struct iovec iov; 1731 struct iovec iov;
1732 struct uio uio; 1732 struct uio uio;
1733 struct usb_full_desc *fd = (struct usb_full_desc *)addr; 1733 struct usb_full_desc *fd = (struct usb_full_desc *)addr;
1734 int error; 1734 int error;
1735 1735
1736 cdesc = ugen_get_cdesc(sc, fd->ufd_config_index, &len); 1736 cdesc = ugen_get_cdesc(sc, fd->ufd_config_index, &len);
 1737 if (cdesc == NULL)
 1738 return (EINVAL);
1737 if (len > fd->ufd_size) 1739 if (len > fd->ufd_size)
1738 len = fd->ufd_size; 1740 len = fd->ufd_size;
1739 iov.iov_base = (void *)fd->ufd_data; 1741 iov.iov_base = (void *)fd->ufd_data;
1740 iov.iov_len = len; 1742 iov.iov_len = len;
1741 uio.uio_iov = &iov; 1743 uio.uio_iov = &iov;
1742 uio.uio_iovcnt = 1; 1744 uio.uio_iovcnt = 1;
1743 uio.uio_resid = len; 1745 uio.uio_resid = len;
1744 uio.uio_offset = 0; 1746 uio.uio_offset = 0;
1745 uio.uio_rw = UIO_READ; 1747 uio.uio_rw = UIO_READ;
1746 uio.uio_vmspace = l->l_proc->p_vmspace; 1748 uio.uio_vmspace = l->l_proc->p_vmspace;
1747 error = uiomove((void *)cdesc, len, &uio); 1749 error = uiomove((void *)cdesc, len, &uio);
1748 free(cdesc, M_TEMP); 1750 free(cdesc, M_TEMP);
1749 return (error); 1751 return (error);