Fix a memory leak in usbf_realloc(), and make the speed configuration array

dynamically allocated. "commit please" deraadt@

2 files changed, 22 insertions, 9 deletions

diff --git a/sys/dev/usb/usbf.c b/sys/dev/usb/usbf.c
index 11edcb855fe..dbd53353d8b 100644
--- a/sys/dev/usb/usbf.c
+++ b/sys/dev/usb/usbf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usbf.c,v 1.10 2007/09/17 01:40:38 fgsch Exp $	*/
+/*	$OpenBSD: usbf.c,v 1.11 2008/06/10 20:50:19 miod Exp $	*/
 
 /*
  * Copyright (c) 2006 Uwe Stuehler <uwe@openbsd.org>
@@ -53,6 +53,7 @@
 #include <sys/param.h>
 #include <sys/device.h>
 #include <sys/kthread.h>
+#include <sys/malloc.h>
 #include <sys/systm.h>
 
 #include <machine/bus.h>
@@ -77,6 +78,8 @@ struct usbf_softc {
 	struct proc		*sc_proc;	/* task thread */
 	TAILQ_HEAD(,usbf_task)	 sc_tskq;	/* task queue head */
 	int			 sc_dying;
+
+	u_int8_t		*sc_hs_config;
 };
 
 #define DEVNAME(sc)	((sc)->sc_dev.dv_xname)
@@ -284,9 +287,6 @@ usbf_host_reset(usbf_bus_handle bus)
  * Device request handling
  */
 
-/* XXX */
-static u_int8_t hs_config[65536];
-
 usbf_status
 usbf_get_descriptor(usbf_device_handle dev, usb_device_request_t *req,
     void **data)
@@ -296,6 +296,7 @@ usbf_get_descriptor(usbf_device_handle dev, usb_device_request_t *req,
 	usb_device_descriptor_t *dd;
 	usb_config_descriptor_t *cd;
 	usb_string_descriptor_t *sd;
+	struct usbf_softc *sc;
 
 	switch (type) {
 	case UDESC_DEVICE:
@@ -336,9 +337,17 @@ usbf_get_descriptor(usbf_device_handle dev, usb_device_request_t *req,
 		cd = usbf_config_descriptor(dev, index);
 		if (cd == NULL)
 			return USBF_INVAL;
-		bcopy(cd, &hs_config, UGETW(cd->wTotalLength));
-		*data = &hs_config;
-		((usb_config_descriptor_t *)&hs_config)->bDescriptorType =
+		sc = dev->bus->usbfctl;
+		if (sc->sc_hs_config == NULL) {
+			/* XXX should allocate more dynamically */
+			sc->sc_hs_config =
+			    (u_int8_t *)malloc(65536, M_USB, M_NOWAIT);
+		}
+		if (sc->sc_hs_config == NULL)
+			return USBF_INVAL;
+		bcopy(cd, sc->sc_hs_config, UGETW(cd->wTotalLength));
+		*data = sc->sc_hs_config;
+		((usb_config_descriptor_t *)sc->sc_hs_config)->bDescriptorType =
 		    UDESC_OTHER_SPEED_CONFIGURATION;
 		USETW(req->wLength, MIN(UGETW(req->wLength),
 		    UGETW(cd->wTotalLength)));
diff --git a/sys/dev/usb/usbf_subr.c b/sys/dev/usb/usbf_subr.c
index 711a08787a7..87b145ec2cc 100644
--- a/sys/dev/usb/usbf_subr.c
+++ b/sys/dev/usb/usbf_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usbf_subr.c,v 1.12 2007/09/11 13:39:34 gilles Exp $	*/
+/*	$OpenBSD: usbf_subr.c,v 1.13 2008/06/10 20:50:19 miod Exp $	*/
 
 /*
  * Copyright (c) 2006 Uwe Stuehler <uwe@openbsd.org>
@@ -22,6 +22,7 @@
 
 #include <sys/param.h>
 #include <sys/malloc.h>
+#include <sys/proc.h>
 #include <sys/systm.h>
 #include <sys/timeout.h>
 
@@ -87,6 +88,8 @@ usbf_realloc(void **pp, size_t *sizep, size_t newsize)
 	oldsize = MIN(*sizep, newsize);
 	if (oldsize > 0)
 		bcopy(*pp, p, oldsize);
+	if (*pp != NULL)
+		free(*pp, M_USB);
 	*pp = p;
 	*sizep = newsize;
 	return p;
@@ -1041,7 +1044,8 @@ usbf_transfer_complete(usbf_xfer_handle xfer)
 
 	pipe->methods->done(xfer);
 
-	/* XXX wake up any processes waiting for the transfer to complete */
+	if (xfer->flags & USBD_SYNCHRONOUS)
+		wakeup(xfer);
 
 	if (!repeat) {
 		if (xfer->status != USBF_NORMAL_COMPLETION &&