Sat May 14 15:28:50 2022 UTC ()
uvideo(4): Avoid exposing streams with invalid descriptors.


(riastradh)
diff -r1.79 -r1.80 src/sys/dev/usb/uvideo.c
cvs diff -r1.79 -r1.80 src/sys/dev/usb/uvideo.c (expand / switch to unified diff)

--- src/sys/dev/usb/uvideo.c 2022/04/24 09:55:48 1.79
+++ src/sys/dev/usb/uvideo.c 2022/05/14 15:28:50 1.80
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: uvideo.c,v 1.79 2022/04/24 09:55:48 hannken Exp $ */ 1/* $NetBSD: uvideo.c,v 1.80 2022/05/14 15:28:50 riastradh Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 2008 Patrick Mahoney 4 * Copyright (c) 2008 Patrick Mahoney
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * This code was written by Patrick Mahoney (pat@polycrystal.org) as 7 * This code was written by Patrick Mahoney (pat@polycrystal.org) as
8 * part of Google Summer of Code 2008. 8 * part of Google Summer of Code 2008.
9 * 9 *
10 * Redistribution and use in source and binary forms, with or without 10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions 11 * modification, are permitted provided that the following conditions
12 * are met: 12 * are met:
13 * 1. Redistributions of source code must retain the above copyright 13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer. 14 * notice, this list of conditions and the following disclaimer.
@@ -32,27 +32,27 @@ @@ -32,27 +32,27 @@
32 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 32 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 33 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
34 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 34 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 35 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
36 * POSSIBILITY OF SUCH DAMAGE. 36 * POSSIBILITY OF SUCH DAMAGE.
37 */ 37 */
38 38
39/* 39/*
40 * USB video specs: 40 * USB video specs:
41 * http://www.usb.org/developers/devclass_docs/USB_Video_Class_1_1.zip 41 * http://www.usb.org/developers/devclass_docs/USB_Video_Class_1_1.zip
42 */ 42 */
43 43
44#include <sys/cdefs.h> 44#include <sys/cdefs.h>
45__KERNEL_RCSID(0, "$NetBSD: uvideo.c,v 1.79 2022/04/24 09:55:48 hannken Exp $"); 45__KERNEL_RCSID(0, "$NetBSD: uvideo.c,v 1.80 2022/05/14 15:28:50 riastradh Exp $");
46 46
47#ifdef _KERNEL_OPT 47#ifdef _KERNEL_OPT
48#include "opt_usb.h" 48#include "opt_usb.h"
49#endif 49#endif
50 50
51#ifdef _MODULE 51#ifdef _MODULE
52#include <sys/module.h> 52#include <sys/module.h>
53#endif 53#endif
54 54
55#include <sys/param.h> 55#include <sys/param.h>
56#include <sys/systm.h> 56#include <sys/systm.h>
57#include <sys/kernel.h> 57#include <sys/kernel.h>
58#include <sys/kmem.h> 58#include <sys/kmem.h>
@@ -603,26 +603,36 @@ uvideo_attach(device_t parent, device_t  @@ -603,26 +603,36 @@ uvideo_attach(device_t parent, device_t
603 ifdesc->bInterfaceSubClass)); 603 ifdesc->bInterfaceSubClass));
604 break; 604 break;
605 } 605 }
606 606
607 } 607 }
608 608
609 609
610 usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev); 610 usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, sc->sc_dev);
611 611
612 if (!pmf_device_register(self, NULL, NULL)) 612 if (!pmf_device_register(self, NULL, NULL))
613 aprint_error_dev(self, "couldn't establish power handler\n"); 613 aprint_error_dev(self, "couldn't establish power handler\n");
614 614
615 SLIST_FOREACH(vs, &sc->sc_stream_list, entries) { 615 SLIST_FOREACH(vs, &sc->sc_stream_list, entries) {
 616 /*
 617 * If the descriptor is invalid, there may be no
 618 * default format.
 619 *
 620 * XXX Maybe this should just be removed from the list
 621 * at some other point, but finding the right other
 622 * point is not trivial.
 623 */
 624 if (vs->vs_default_format == NULL)
 625 continue;
616 /* XXX initialization of vs_videodev is racy */ 626 /* XXX initialization of vs_videodev is racy */
617 vs->vs_videodev = video_attach_mi(&uvideo_hw_if, sc->sc_dev, 627 vs->vs_videodev = video_attach_mi(&uvideo_hw_if, sc->sc_dev,
618 vs); 628 vs);
619 } 629 }
620 630
621 return; 631 return;
622 632
623bad: 633bad:
624 if (err != USBD_NORMAL_COMPLETION) { 634 if (err != USBD_NORMAL_COMPLETION) {
625 DPRINTF(("uvideo_attach: error: %s (%d)\n", 635 DPRINTF(("uvideo_attach: error: %s (%d)\n",
626 usbd_errstr(err), err)); 636 usbd_errstr(err), err));
627 } 637 }
628 return; 638 return;