imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

ietp: guard iicbus_get_addr with devclass check

Browse Source 
When a USB HID device triggers identify,
the grandparent is usbhid on a USB hub.
Calling iicbus_get_addr() on a non-iicbus device
hits a KASSERT panic.

Reviewed by:	adrian
Differential Revision:	https://reviews.freebsd.org/D58432
This commit is contained in:
Abdelkader Boudih authored and Adrian Chadd committed 2026-07-24 19:01:54 -07:00
1 parent e0b235ecd4
commit 3fbffbcbec
1 file changed
+6 -5
Download Patch File Download Diff File Expand all files Collapse all files
sys/dev/hid/ietp.c
+6 -5
View File
@@ -450,13 +450,10 @@ ietp_iic_identify(driver_t *driver, device_t parent)
{
device_t iichid = device_get_parent(parent);
static const uint16_t reg = IETP_PATTERN;
uint16_t addr = iicbus_get_addr(iichid) << 1;
uint16_t addr;
uint8_t resp[2];
uint8_t cmd[2] = { reg & 0xff, (reg >> 8) & 0xff };
struct iic_msg msgs[2] = {
{ addr, IIC_M_WR | IIC_M_NOSTOP, sizeof(cmd), cmd },
{ addr, IIC_M_RD, sizeof(resp), resp },
};
struct iic_msg msgs[2];
struct iic_rdwr_data ird = { msgs, nitems(msgs) };
uint8_t pattern;
@@ -466,6 +463,10 @@ ietp_iic_identify(driver_t *driver, device_t parent)
if (device_get_devclass(iichid) != devclass_find("iichid"))
return;
addr = iicbus_get_addr(iichid) << 1;
msgs[0] = (struct iic_msg){ addr, IIC_M_WR | IIC_M_NOSTOP, sizeof(cmd), cmd };
msgs[1] = (struct iic_msg){ addr, IIC_M_RD, sizeof(resp), resp };
DPRINTF("Read reg 0x%04x with size %zu\n", reg, sizeof(resp));
if (hid_ioctl(parent, I2CRDWR, (uintptr_t)&ird) != 0)