diff options
| author |   mpi <mpi@openbsd.org> | 2016-01-14 19:53:59 +0000 |
|---|---|---|
| committer | mpi <mpi@openbsd.org> | 2016-01-14 19:53:59 +0000 |
| commit | 9e239a087234487eca5e18bb8fed2676540c151d (patch) | |
| tree | fd36a0c8c457fd6df358bdb35a0bf5a5626d1922 /sys | |
| parent | Check whether a string from imsg is empty by dereferencing the char* (diff) | |
| download | wireguard-openbsd-9e239a087234487eca5e18bb8fed2676540c151d.tar.xz wireguard-openbsd-9e239a087234487eca5e18bb8fed2676540c151d.zip | |
Prevent a NULL dereference when detaching a USB device with ugen(4)
disabled or if allocating memory during the attachment process failed.
Problem reported by and original diff from James Hastings on bugs@.
ok deraadt@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/usb/usb_subr.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/sys/dev/usb/usb_subr.c b/sys/dev/usb/usb_subr.c index cd3dc2916f1..2ffc97cb379 100644 --- a/sys/dev/usb/usb_subr.c +++ b/sys/dev/usb/usb_subr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: usb_subr.c,v 1.118 2015/10/24 14:01:40 stsp Exp $ */ +/* $OpenBSD: usb_subr.c,v 1.119 2016/01/14 19:53:59 mpi Exp $ */ /* $NetBSD: usb_subr.c,v 1.103 2003/01/10 11:19:13 augustss Exp $ */ /* $FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $ */ @@ -1382,8 +1382,10 @@ usbd_detach(struct usbd_device *dev, struct device *parent) usbd_deactivate(dev); - for (i = 0; dev->subdevs[i] != NULL; i++) - rv |= config_detach(dev->subdevs[i], DETACH_FORCE); + if (dev->ndevs > 0) { + for (i = 0; dev->subdevs[i] != NULL; i++) + rv |= config_detach(dev->subdevs[i], DETACH_FORCE); + } if (rv == 0) usb_free_device(dev); |