crash from midi device

[Aaron LI]

On June 6, 2019 9:01:13 AM GMT+08:00, Tse <1 at tse.gratis> wrote:
>I was having trouble getting an account to submit a bug report
>
>So here's a bug fix instead!!
>
>The original bug was a repeatable crash when plugging in usb midi
>device:
>uaudio0: <vendor 0x16c0 MIDI EXpression BLUE, class 0/0, rev 2.00/1.03,
>addr 1> on usbus0
>panic: trying to free NULL pointer
>cpuid = 1
>Trace beginning at frame 0xfffff801eb967810
>kfree() at kfree+0x5b0 0xffffffff8058e900
>kfree() at kfree+0x5b0 0xffffffff8058e900
>uaudio_attach() at uaudio_attach+0x1b5 0xffffffff862040a5
>device_doattach() at device_doattach+0x369 0xffffffff805bd2a9
>usb_probe_and_attach() at usb_probe_and_attach+0x176 0xffffffff809091a6
>uhub_explore() at uhub_explore+0x221 0xffffffff8090ffa1
>Debugger("panic")
>
>--- a/sys/bus/u4b/audio/uaudio.c
>+++ b/sys/bus/u4b/audio/uaudio.c
>@@ -4871,7 +4871,7 @@ uaudio_mixer_fill_info(struct uaudio_softc *sc,
>
>        if (desc == NULL) {
>                DPRINTF("no Audio Control header\n");
>-               goto done;
>+               return;
>        }
>        acdp = desc;
>
>@@ -4879,7 +4879,7 @@ uaudio_mixer_fill_info(struct uaudio_softc *sc,
>            (acdp->bDescriptorType != UDESC_CS_INTERFACE) ||
>            (acdp->bDescriptorSubtype != UDESCSUB_AC_HEADER)) {
>                DPRINTF("invalid Audio Control header\n");
>-               goto done;
>+               return;
>        }
>        /* "wTotalLen" is allowed to be corrupt */
>        wTotalLen = UGETW(acdp->wTotalLength) - acdp->bLength;
>@@ -4895,7 +4895,7 @@ uaudio_mixer_fill_info(struct uaudio_softc *sc,
>
>        if (iot == NULL) {
>                DPRINTF("no memory!\n");
>-               goto done;
>+               return;
>        }
>        while ((desc = usb_desc_foreach(cd, desc))) {

Tse, thanks you for the patch.

The sign up in the bug tracker has been disabled to fight spam.  If you want an account, ask here or on the IRC.


Cheers,
-- 
Aaron