Module Name: src
Committed By: maxv
Date: Sat Sep 14 12:37:35 UTC 2019
Modified Files:
src/sys/dev/usb: if_otus.c
Log Message:
Fix NULL derefs, to prevent kernel crashes when detaching an otus0 device.
Found with vHCI.
To generate a diff of this commit:
cvs rdiff -u -r1.38 -r1.39 src/sys/dev/usb/if_otus.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/if_otus.c
diff -u src/sys/dev/usb/if_otus.c:1.38 src/sys/dev/usb/if_otus.c:1.39
--- src/sys/dev/usb/if_otus.c:1.38 Tue May 28 07:41:50 2019
+++ src/sys/dev/usb/if_otus.c Sat Sep 14 12:37:34 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: if_otus.c,v 1.38 2019/05/28 07:41:50 msaitoh Exp $ */
+/* $NetBSD: if_otus.c,v 1.39 2019/09/14 12:37:34 maxv Exp $ */
/* $OpenBSD: if_otus.c,v 1.18 2010/08/27 17:08:00 jsg Exp $ */
/*-
@@ -23,7 +23,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_otus.c,v 1.38 2019/05/28 07:41:50 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_otus.c,v 1.39 2019/09/14 12:37:34 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -1107,6 +1107,9 @@ otus_free_tx_cmd(struct otus_softc *sc)
DPRINTFN(DBG_FN, sc, "\n");
+ if (sc->sc_cmd_tx_pipe == NULL)
+ return;
+
/* Make sure no transfers are pending. */
usbd_abort_pipe(sc->sc_cmd_tx_pipe);
@@ -1158,6 +1161,9 @@ otus_free_tx_data_list(struct otus_softc
DPRINTFN(DBG_FN, sc, "\n");
+ if (sc->sc_data_tx_pipe == NULL)
+ return;
+
/* Make sure no transfers are pending. */
usbd_abort_pipe(sc->sc_data_tx_pipe);
@@ -1203,6 +1209,9 @@ otus_free_rx_data_list(struct otus_softc
DPRINTFN(DBG_FN, sc, "\n");
+ if (sc->sc_data_rx_pipe == NULL)
+ return;
+
/* Make sure no transfers are pending. */
usbd_abort_pipe(sc->sc_data_rx_pipe);
