Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

uhidev(9): Define UHIDEV_MAXREPID = 255. 

Report ids are limited by the HID spec to a single byte.

- Clamp max report id in report descriptor to this.

- Prune dead refcnt-overflow error branches.  Assert instead.
This commit is contained in:
riastradh 2022-03-28 12:44:37 +00:00
parent 7b337ee289
commit 96edebbe82
2 changed files with 11 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
sys/dev/usb/uhidev.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: uhidev.c,v 1.91 2022/03/28 12:44:28 riastradh Exp $ */
/* $NetBSD: uhidev.c,v 1.92 2022/03/28 12:44:37 riastradh Exp $ */
/*
* Copyright (c) 2001, 2012 The NetBSD Foundation, Inc.
@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: uhidev.c,v 1.91 2022/03/28 12:44:28 riastradh Exp $");
__KERNEL_RCSID(0, "$NetBSD: uhidev.c,v 1.92 2022/03/28 12:44:37 riastradh Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@ -458,7 +458,7 @@ uhidev_maxrepid(void *buf, int len)
if ((int)h.report_ID > maxid)
maxid = h.report_ID;
hid_end_parse(d);
return maxid;
return MIN(maxid, UHIDEV_MAXREPID);
}
static int
@ -671,11 +671,11 @@ uhidev_open_pipes(struct uhidev_softc *sc)
/*
* If the pipes are already open, just increment the reference
* count, or fail if it would overflow.
* count. The reference count is limited by the number of
* report ids, so this can't overflow.
*/
if (sc->sc_refcnt) {
if (sc->sc_refcnt == INT_MAX)
return EBUSY;
KASSERT(sc->sc_refcnt < UHIDEV_MAXREPID);
sc->sc_refcnt++;
return 0;
}
@ -700,12 +700,9 @@ uhidev_open_pipes(struct uhidev_softc *sc)
if (error)
goto out;
if (sc->sc_refcnt) {
if (sc->sc_refcnt == INT_MAX) {
error = EBUSY;
} else {
sc->sc_refcnt++;
error = 0;
}
KASSERT(sc->sc_refcnt < UHIDEV_MAXREPID);
sc->sc_refcnt++;
error = 0;
goto out0;
}
mutex_exit(&sc->sc_lock);

3
sys/dev/usb/uhidev.h
View File

@ -1,4 +1,4 @@
/* $NetBSD: uhidev.h,v 1.26 2022/03/28 12:44:17 riastradh Exp $ */
/* $NetBSD: uhidev.h,v 1.27 2022/03/28 12:44:37 riastradh Exp $ */
/*
* Copyright (c) 2001 The NetBSD Foundation, Inc.
@ -54,5 +54,6 @@ usbd_status uhidev_write_async(struct uhidev *, void *, int, int, int,
usbd_callback, void *);
#define UHIDEV_OSIZE 64
#define UHIDEV_MAXREPID 255
#endif /* _DEV_USB_UHIDEV_H_ */