diff options
| author | Martin Pieuchot <mpi@cvs.openbsd.org> | 2016-01-14 19:54:00 +0000 |
|---|---|---|
| committer | Martin Pieuchot <mpi@cvs.openbsd.org> | 2016-01-14 19:54:00 +0000 |
| commit | 6c55a851e27978e5af9855d5162c1f024f863d11 (patch) | |
| tree | 482f45df48b3a64406c31e2b8475d2692e269fa6 /sys/dev/usb/usb_subr.c | |
| parent | ecdd21652c9aa0c53157d7a06d7ac3d3acfad039 (diff) | |
Prevent a NULL dereference when detaching a USB device with ugen(4)
disabled or if allocating memory during the attachment process failed.
Problem reported by and original diff from James Hastings on bugs@.
ok deraadt@
Diffstat (limited to 'sys/dev/usb/usb_subr.c')
| -rw-r--r-- | sys/dev/usb/usb_subr.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/sys/dev/usb/usb_subr.c b/sys/dev/usb/usb_subr.c index cd3dc2916f1..2ffc97cb379 100644 --- a/sys/dev/usb/usb_subr.c +++ b/sys/dev/usb/usb_subr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: usb_subr.c,v 1.118 2015/10/24 14:01:40 stsp Exp $ */ +/* $OpenBSD: usb_subr.c,v 1.119 2016/01/14 19:53:59 mpi Exp $ */ /* $NetBSD: usb_subr.c,v 1.103 2003/01/10 11:19:13 augustss Exp $ */ /* $FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $ */ @@ -1382,8 +1382,10 @@ usbd_detach(struct usbd_device *dev, struct device *parent) usbd_deactivate(dev); - for (i = 0; dev->subdevs[i] != NULL; i++) - rv |= config_detach(dev->subdevs[i], DETACH_FORCE); + if (dev->ndevs > 0) { + for (i = 0; dev->subdevs[i] != NULL; i++) + rv |= config_detach(dev->subdevs[i], DETACH_FORCE); + } if (rv == 0) usb_free_device(dev); |