[src/trunk]: src/sys/dev/usb Fix sloppy mistakes in previous.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/807d32c93159
branches:  trunk
changeset: 1012930:807d32c93159
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sun Aug 16 06:17:31 2020 +0000

description:
Fix sloppy mistakes in previous.

1. Give the offset of the rbnode, not some other random members to
   overwrite with garbage.

2. Don't try to unlock a mutex at NULL.

3. Make sure all paths out after ugenif_acquire go via
   ugenif_release.

diffstat:

 sys/dev/usb/ugen.c |  31 +++++++++++++++++--------------
 1 files changed, 17 insertions(+), 14 deletions(-)

diffs (68 lines):

diff -r ee0f09d6ae4a -r 807d32c93159 sys/dev/usb/ugen.c
--- a/sys/dev/usb/ugen.c        Sun Aug 16 03:48:59 2020 +0000
+++ b/sys/dev/usb/ugen.c        Sun Aug 16 06:17:31 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ugen.c,v 1.155 2020/08/16 02:37:19 riastradh Exp $     */
+/*     $NetBSD: ugen.c,v 1.156 2020/08/16 06:17:31 riastradh Exp $     */
 
 /*
  * Copyright (c) 1998, 2004 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
 
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ugen.c,v 1.155 2020/08/16 02:37:19 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ugen.c,v 1.156 2020/08/16 06:17:31 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_compat_netbsd.h"
@@ -175,7 +175,7 @@
 static const rb_tree_ops_t ugenif_tree_ops = {
        .rbto_compare_nodes = compare_ugen,
        .rbto_compare_key = compare_ugen_key,
-       .rbto_node_offset = offsetof(struct ugen_softc, sc_unit),
+       .rbto_node_offset = offsetof(struct ugen_softc, sc_node),
 };
 
 static void
@@ -215,17 +215,18 @@
 
        mutex_enter(&ugenif.lock);
        sc = rb_tree_find_node(&ugenif.tree, &unit);
-       if (sc) {
-               mutex_enter(&sc->sc_lock);
-               if (sc->sc_dying) {
-                       sc = NULL;
-               } else {
-                       KASSERT(sc->sc_refcnt < INT_MAX);
-                       sc->sc_refcnt++;
-               }
+       if (sc == NULL)
+               goto out;
+       mutex_enter(&sc->sc_lock);
+       if (sc->sc_dying) {
                mutex_exit(&sc->sc_lock);
+               sc = NULL;
+               goto out;
        }
-       mutex_exit(&ugenif.lock);
+       KASSERT(sc->sc_refcnt < INT_MAX);
+       sc->sc_refcnt++;
+       mutex_exit(&sc->sc_lock);
+out:   mutex_exit(&ugenif.lock);
 
        return sc;
 }
@@ -608,8 +609,10 @@
                                goto out;
                        }
                        isize = UGETW(edesc->wMaxPacketSize);
-                       if (isize == 0) /* shouldn't happen */
-                               return EINVAL;
+                       if (isize == 0) {       /* shouldn't happen */
+                               error = EINVAL;
+                               goto out;
+                       }
                        sce->ibuf = kmem_alloc(isize * UGEN_NISOFRAMES,
                                KM_SLEEP);
                        sce->cur = sce->fill = sce->ibuf;