diff options
| author | ians <ians@cvs.openbsd.org> | 2017-07-21 20:13:42 +0000 |
|---|---|---|
| committer | ians <ians@cvs.openbsd.org> | 2017-07-21 20:13:42 +0000 |
| commit | 35471a0b16547998da9b08ad8457ab8e6a5a6bfc (patch) | |
| tree | 3b64cf98670c66646d183536ad24472f85c2f3e0 /sys | |
| parent | 8d3ecf4f50cef80454830573baac50499af3aa28 (diff) | |
Do not permit USB ioctl handler malloc(9)'s to block as this interferes
with expected behavior.
OK mpi@ patrick@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/usb/ugen.c | 7 | ||||
| -rw-r--r-- | sys/dev/usb/usb.c | 7 |
2 files changed, 10 insertions, 4 deletions
diff --git a/sys/dev/usb/ugen.c b/sys/dev/usb/ugen.c index 9bf42c81574..27e910e874e 100644 --- a/sys/dev/usb/ugen.c +++ b/sys/dev/usb/ugen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ugen.c,v 1.95 2017/04/08 02:57:25 deraadt Exp $ */ +/* $OpenBSD: ugen.c,v 1.96 2017/07/21 20:13:41 ians Exp $ */ /* $NetBSD: ugen.c,v 1.63 2002/11/26 18:49:48 christos Exp $ */ /* $FreeBSD: src/sys/dev/usb/ugen.c,v 1.26 1999/11/17 22:33:41 n_hibma Exp $ */ @@ -1167,7 +1167,10 @@ ugen_do_ioctl(struct ugen_softc *sc, int endpt, u_long cmd, caddr_t addr, ur->ucr_request.bmRequestType & UT_READ ? UIO_READ : UIO_WRITE; uio.uio_procp = p; - ptr = malloc(len, M_TEMP, M_WAITOK); + if ((ptr = malloc(len, M_TEMP, M_NOWAIT)) == NULL) { + error = ENOMEM; + goto ret; + } if (uio.uio_rw == UIO_WRITE) { error = uiomove(ptr, len, &uio); if (error) diff --git a/sys/dev/usb/usb.c b/sys/dev/usb/usb.c index 21e4371c19c..1d9954e74ab 100644 --- a/sys/dev/usb/usb.c +++ b/sys/dev/usb/usb.c @@ -1,4 +1,4 @@ -/* $OpenBSD: usb.c,v 1.112 2017/04/08 02:57:25 deraadt Exp $ */ +/* $OpenBSD: usb.c,v 1.113 2017/07/21 20:13:41 ians Exp $ */ /* $NetBSD: usb.c,v 1.77 2003/01/01 00:10:26 thorpej Exp $ */ /* @@ -649,7 +649,10 @@ usbioctl(dev_t devt, u_long cmd, caddr_t data, int flag, struct proc *p) ur->ucr_request.bmRequestType & UT_READ ? UIO_READ : UIO_WRITE; uio.uio_procp = p; - ptr = malloc(len, M_TEMP, M_WAITOK); + if ((ptr = malloc(len, M_TEMP, M_NOWAIT)) == NULL) { + error = ENOMEM; + goto ret; + } if (uio.uio_rw == UIO_WRITE) { error = uiomove(ptr, len, &uio); if (error) |