diff options
| author | Patrick Wildt <patrick@cvs.openbsd.org> | 2017-10-19 21:23:48 +0000 |
|---|---|---|
| committer | Patrick Wildt <patrick@cvs.openbsd.org> | 2017-10-19 21:23:48 +0000 |
| commit | e97f2b7dc4d3cfbc51a27c8404baf56a58641530 (patch) | |
| tree | 6c679a76b018865371bc708741adf38d9ef6b95e | |
| parent | af72bc510b801005f53aa561985bb0654505017d (diff) | |
Don't just return but setup and resubmit the transfer if we're not
getting the data we expect to be getting. Otherwise the firmware
can starve our USB RX descriptors using invalid packets.
Caught by Jared McNeill.
| -rw-r--r-- | sys/dev/usb/if_bwfm_usb.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/sys/dev/usb/if_bwfm_usb.c b/sys/dev/usb/if_bwfm_usb.c index db37acfb980..268cc7b8650 100644 --- a/sys/dev/usb/if_bwfm_usb.c +++ b/sys/dev/usb/if_bwfm_usb.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_bwfm_usb.c,v 1.3 2017/10/19 12:35:17 patrick Exp $ */ +/* $OpenBSD: if_bwfm_usb.c,v 1.4 2017/10/19 21:23:47 patrick Exp $ */ /* * Copyright (c) 2010-2016 Broadcom Corporation * Copyright (c) 2016,2017 Patrick Wildt <patrick@blueri.se> @@ -429,21 +429,20 @@ bwfm_usb_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status) hdr = (void *)data->buf; if (len < sizeof(*hdr)) - return; + goto resubmit; len -= sizeof(*hdr); off += sizeof(*hdr); if (len < hdr->data_offset << 2) - return; + goto resubmit; len -= hdr->data_offset << 2; off += hdr->data_offset << 2; bwfm_rx(&sc->sc_sc, &data->buf[off], len); +resubmit: usbd_setup_xfer(data->xfer, sc->sc_rx_pipeh, data, data->buf, BWFM_RXBUFSZ, USBD_SHORT_XFER_OK | USBD_NO_COPY, USBD_NO_TIMEOUT, bwfm_usb_rxeof); - -resubmit: error = usbd_transfer(data->xfer); if (error != 0 && error != USBD_IN_PROGRESS) printf("%s: could not set up new transfer: %s\n", |