[src/trunk]: src/sys/dev/usb usb(4): Verify dev->ud_subdevs is still there be...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6035525e68e4
branches:  trunk
changeset: 983850:6035525e68e4
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sat Jun 12 12:11:27 2021 +0000

description:
usb(4): Verify dev->ud_subdevs is still there before freeing it.

usbd_attachinterfaces may sleep, and if it does, it releases the
kernel lock, in which case another thread may free dev->ud_subdevs.

diffstat:

 sys/dev/usb/usb_subr.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r c8dfd19887cf -r 6035525e68e4 sys/dev/usb/usb_subr.c
--- a/sys/dev/usb/usb_subr.c    Sat Jun 12 12:11:11 2021 +0000
+++ b/sys/dev/usb/usb_subr.c    Sat Jun 12 12:11:27 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: usb_subr.c,v 1.251 2021/06/12 12:11:11 riastradh Exp $ */
+/*     $NetBSD: usb_subr.c,v 1.252 2021/06/12 12:11:27 riastradh Exp $ */
 /*     $FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $   */
 
 /*
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.251 2021/06/12 12:11:11 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: usb_subr.c,v 1.252 2021/06/12 12:11:27 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_compat_netbsd.h"
@@ -1072,7 +1072,7 @@
 
                err = usbd_attachinterfaces(parent, dev, port, NULL);
 
-               if (!dev->ud_nifaces_claimed) {
+               if (dev->ud_subdevs && dev->ud_nifaces_claimed == 0) {
                        kmem_free(dev->ud_subdevs,
                            dev->ud_subdevlen * sizeof(device_t));
                        dev->ud_subdevs = 0;