[src/trunk]: src/sys/dev/usb Reset ud_pipe0 to NULL before calling usbd_setup...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f8a0a869f9d1
branches:  trunk
changeset: 459533:f8a0a869f9d1
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sun Sep 15 09:24:38 2019 +0000

description:
Reset ud_pipe0 to NULL before calling usbd_setup_pipe_flags(). If the call
fails we call usbd_remove_device(), which tries to free ud_pipe0, but it
was already freed.

While here, add two sanity checks, to prevent possible surprises.

diffstat:

 sys/dev/usb/usb_subr.c |  10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)

diffs (45 lines):

diff -r 18dbfaf498af -r f8a0a869f9d1 sys/dev/usb/usb_subr.c
--- a/sys/dev/usb/usb_subr.c    Sun Sep 15 09:21:36 2019 +0000
+++ b/sys/dev/usb/usb_subr.c    Sun Sep 15 09:24:38 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: usb_subr.c,v 1.239 2019/08/28 01:44:39 mrg Exp $       */
+/*     $NetBSD: usb_subr.c,v 1.240 2019/09/15 09:24:38 maxv Exp $      */
 /*     $FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $   */
 
 /*
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.239 2019/08/28 01:44:39 mrg Exp $");
+__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.240 2019/09/15 09:24:38 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_compat_netbsd.h"
@@ -1353,6 +1353,7 @@
 
        /* Re-establish the default pipe with the new MPS. */
        usbd_kill_pipe(dev->ud_pipe0);
+       dev->ud_pipe0 = NULL;
        err = usbd_setup_pipe_flags(dev, 0, &dev->ud_ep0, USBD_DEFAULT_INTERVAL,
            &dev->ud_pipe0, USBD_MPSAFE);
        if (err) {
@@ -1378,6 +1379,7 @@
 
        /* Re-establish the default pipe with the new address. */
        usbd_kill_pipe(dev->ud_pipe0);
+       dev->ud_pipe0 = NULL;
        err = usbd_setup_pipe_flags(dev, 0, &dev->ud_ep0, USBD_DEFAULT_INTERVAL,
            &dev->ud_pipe0, USBD_MPSAFE);
        if (err) {
@@ -1431,6 +1433,10 @@
        err = usbd_get_device_desc(dev, udd);
        if (err)
                return err;
+       if (udd->bDescriptorType != UDESC_DEVICE)
+               return USBD_INVAL;
+       if (udd->bLength < USB_DEVICE_DESCRIPTOR_SIZE)
+               return USBD_INVAL;
 
        DPRINTFN(15, "bLength             %5ju", udd->bLength, 0, 0, 0);
        DPRINTFN(15, "bDescriptorType     %5ju", udd->bDescriptorType, 0, 0, 0);