 @@ -1,14 +1,14 @@
-/*	$NetBSD: uhidev.c,v 1.91 2022/03/28 12:44:28 riastradh Exp $	*/
+/*	$NetBSD: uhidev.c,v 1.92 2022/03/28 12:44:37 riastradh Exp $	*/
 /*
  * Copyright (c) 2001, 2012 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology and Matthew R. Green (mrg@eterna.com.au).
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
 @@ -25,27 +25,27 @@
  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
 /*
  * HID spec: http://www.usb.org/developers/devclass_docs/HID1_11.pdf
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uhidev.c,v 1.91 2022/03/28 12:44:28 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uhidev.c,v 1.92 2022/03/28 12:44:37 riastradh Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
 #endif
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/atomic.h>
 #include <sys/conf.h>
 #include <sys/device.h>
 #include <sys/ioctl.h>
 #include <sys/kernel.h>
 @@ -448,27 +448,27 @@ uhidev_attach(device_t parent, device_t
 static int
 uhidev_maxrepid(void *buf, int len)
+{
 	struct hid_data *d;
 	struct hid_item h;
 	int maxid;
 	maxid = -1;
 	h.report_ID = 0;
 	for (d = hid_start_parse(buf, len, hid_none); hid_get_item(d, &h); )
 		if ((int)h.report_ID > maxid)
 			maxid = h.report_ID;
 	hid_end_parse(d);
-	return maxid;
+	return MIN(maxid, UHIDEV_MAXREPID);
+}
 static int
 uhidevprint(void *aux, const char *pnp)
+{
 	struct uhidev_attach_arg *uha = aux;
 	if (pnp)
 		aprint_normal("uhid at %s", pnp);
 	if (uha->reportid != 0)
 		aprint_normal(" reportid %d", uha->reportid);
 	return UNCONF;
+}
 @@ -661,61 +661,58 @@ uhidev_config_exit(struct uhidev_softc *
  *	Ensure the pipes of the softc are open.  Caller must hold
  *	sc_lock, which may be released and reacquired.
  */
 static int
 uhidev_open_pipes(struct uhidev_softc *sc)
+{
 	usbd_status err;
 	int error;
 	KASSERT(mutex_owned(&sc->sc_lock));
 	/*
 	 * If the pipes are already open, just increment the reference
-	 * count, or fail if it would overflow.
+	 * count.  The reference count is limited by the number of
 	 * report ids, so this can't overflow.
 	 */
 	if (sc->sc_refcnt) {
-		if (sc->sc_refcnt == INT_MAX)
+		KASSERT(sc->sc_refcnt < UHIDEV_MAXREPID);
 			return EBUSY;
 		sc->sc_refcnt++;
 		return 0;
+	}
 	/*
 	 * If there's no input data to prepare, don't bother with the
 	 * pipes.  We assume any device that does output also does
 	 * input; if you have a device where this is wrong, then
 	 * uhidev_write will fail gracefully (it checks sc->sc_opipe),
 	 * and you can use that device to test the changes needed to
 	 * open the output pipe here.
 	 */
 	if (sc->sc_isize == 0)
 		return 0;
 	/*
 	 * Lock the configuration and release sc_lock -- we may sleep
 	 * to allocate.  If someone else got in first, we're done;
 	 * otherwise open the pipes.
 	 */
 	error = uhidev_config_enter(sc);
 	if (error)
 		goto out;
 	if (sc->sc_refcnt) {
-		if (sc->sc_refcnt == INT_MAX) {
+		KASSERT(sc->sc_refcnt < UHIDEV_MAXREPID);
-			error = EBUSY;
+		sc->sc_refcnt++;
-		} else {
+		error = 0;
 			sc->sc_refcnt++;
 			error = 0;
 		goto out0;
+	}
 	mutex_exit(&sc->sc_lock);
 	/* Allocate an input buffer.  */
 	sc->sc_ibuf = kmem_alloc(sc->sc_isize, KM_SLEEP);
 	/* Set up input interrupt pipe. */
 	DPRINTF(("%s: isize=%d, ep=0x%02x\n", __func__, sc->sc_isize,
 		 sc->sc_iep_addr));
 	err = usbd_open_pipe_intr(sc->sc_iface, sc->sc_iep_addr,
 		  USBD_SHORT_XFER_OK, &sc->sc_ipipe, sc, sc->sc_ibuf,

 @@ -1,14 +1,14 @@
-/*	$NetBSD: uhidev.h,v 1.26 2022/03/28 12:44:17 riastradh Exp $	*/
+/*	$NetBSD: uhidev.h,v 1.27 2022/03/28 12:44:37 riastradh Exp $	*/
 /*
  * Copyright (c) 2001 The NetBSD Foundation, Inc.
  * All rights reserved.
+ *
  * This code is derived from software contributed to The NetBSD Foundation
  * by Lennart Augustsson (lennart@augustsson.net) at
  * Carlstedt Research & Technology.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
 @@ -44,15 +44,16 @@ struct uhidev_attach_arg {
 };
 void uhidev_get_report_desc(struct uhidev *, void **, int *);
 int uhidev_open(struct uhidev *, void (*)(void *, void *, unsigned), void *);
 void uhidev_stop(struct uhidev *);
 void uhidev_close(struct uhidev *);
 usbd_status uhidev_set_report(struct uhidev *, int, void *, int);
 usbd_status uhidev_get_report(struct uhidev *, int, void *, int);
 usbd_status uhidev_write(struct uhidev *, void *, int);
 usbd_status uhidev_write_async(struct uhidev *, void *, int, int, int,
     usbd_callback, void *);
 #define	UHIDEV_OSIZE	64
 #define	UHIDEV_MAXREPID	255
 #endif	/* _DEV_USB_UHIDEV_H_ */