From 6ff1c3a816234ce5f81366d901cbfd6867e43f12 Mon Sep 17 00:00:00 2001
From: Martin Pieuchot <mpi@cvs.openbsd.org>
Date: Tue, 20 Nov 2018 11:51:24 +0000
Subject: Revert free sizes for `subdevs' array, it is incorrect.

Reported by anton@ and Natasha Kerensikova
---
 sys/dev/usb/usb_subr.c | 11 ++++-------
 sys/dev/usb/usbdivar.h |  3 +--
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/sys/dev/usb/usb_subr.c b/sys/dev/usb/usb_subr.c
index 1e09fe3dd22..e371603f6a9 100644
--- a/sys/dev/usb/usb_subr.c
+++ b/sys/dev/usb/usb_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usb_subr.c,v 1.144 2018/11/18 16:44:30 mpi Exp $ */
+/*	$OpenBSD: usb_subr.c,v 1.145 2018/11/20 11:51:23 mpi Exp $ */
 /*	$NetBSD: usb_subr.c,v 1.103 2003/01/10 11:19:13 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $	*/
 
@@ -891,7 +891,6 @@ usbd_probe_and_attach(struct device *parent, struct usbd_device *dev, int port,
 			err = USBD_NOMEM;
 			goto fail;
 		}
-		dev->nsubdev = 2;
 		dev->subdevs[dev->ndevs++] = dv;
 		dev->subdevs[dev->ndevs] = 0;
 		err = USBD_NORMAL_COMPLETION;
@@ -934,7 +933,6 @@ usbd_probe_and_attach(struct device *parent, struct usbd_device *dev, int port,
 		/* add 1 for possible ugen and 1 for NULL terminator */
 		dev->subdevs = mallocarray(nifaces + 2, sizeof(dv), M_USB,
 		    M_NOWAIT | M_ZERO);
-		dev->nsubdev = nifaces + 2;
 		if (dev->subdevs == NULL) {
 			free(ifaces, M_USB, nifaces * sizeof(*ifaces));
 			err = USBD_NOMEM;
@@ -966,9 +964,8 @@ usbd_probe_and_attach(struct device *parent, struct usbd_device *dev, int port,
 				goto fail;
 		}
 
-		free(dev->subdevs, M_USB, dev->nsubdev * sizeof(*dev->subdevs));
+		free(dev->subdevs, M_USB, (nifaces + 2) * sizeof(dv));
 		dev->subdevs = NULL;
-		dev->nsubdev = 0;
 	}
 	/* No interfaces were attached in any of the configurations. */
 
@@ -993,7 +990,6 @@ generic:
 				goto fail;
 			}
 		}
-		dev->nsubdev = 2;
 		dev->subdevs[dev->ndevs++] = dv;
 		dev->subdevs[dev->ndevs] = 0;
 		err = USBD_NORMAL_COMPLETION;
@@ -1411,7 +1407,8 @@ usb_free_device(struct usbd_device *dev)
 	}
 	if (dev->cdesc != NULL)
 		free(dev->cdesc, M_USB, UGETW(dev->cdesc->wTotalLength));
-	free(dev->subdevs, M_USB, dev->nsubdev * sizeof(*dev->subdevs));
+	if (dev->subdevs != NULL)
+		free(dev->subdevs, M_USB, 0);
 	dev->bus->devices[dev->address] = NULL;
 
 	if (dev->vendor != NULL)
diff --git a/sys/dev/usb/usbdivar.h b/sys/dev/usb/usbdivar.h
index 3a612f997ed..ee92ce7d6de 100644
--- a/sys/dev/usb/usbdivar.h
+++ b/sys/dev/usb/usbdivar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usbdivar.h,v 1.77 2018/11/17 20:17:10 mpi Exp $ */
+/*	$OpenBSD: usbdivar.h,v 1.78 2018/11/20 11:51:23 mpi Exp $ */
 /*	$NetBSD: usbdivar.h,v 1.70 2002/07/11 21:14:36 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usbdivar.h,v 1.11 1999/11/17 22:33:51 n_hibma Exp $	*/
 
@@ -158,7 +158,6 @@ struct usbd_device {
 	const struct usbd_quirks     *quirks;  /* device quirks, always set */
 	struct usbd_hub	       *hub;           /* only if this is a hub */
 	struct device         **subdevs;       /* sub-devices, 0 terminated */
-	int			nsubdev;       /* size of the `subdevs' array */
 	int			ndevs;	       /* # of subdevs */
 
 	char                   *serial;        /* serial number, can be NULL */
-- 
cgit v1.2.3