⬢ DragonFlyBSD Kernel Audit
DF-5476 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/u4b/serial/ubsa.c
+++ b/sys/bus/u4b/serial/ubsa.c
@@ -119,6 +119,9 @@
 #define	UBSA_FLOW_OXON		0x0080
 #define	UBSA_FLOW_IXON		0x0100
 
+/* bounded timeout for cfg-path (tty ioctl / open / close) EP0 requests */
+#define	UBSA_CFG_TIMEOUT	250	/* ms */
+
 /* line status register */
 #define	UBSA_LSR_TSRE		0x40	/* Transmitter empty: byte sent */
 #define	UBSA_LSR_TXRDY		0x20	/* Transmitter buffer empty */
@@ -169,7 +172,7 @@
 static usb_callback_t ubsa_read_callback;
 static usb_callback_t ubsa_intr_callback;
 
-static void	ubsa_cfg_request(struct ubsa_softc *, uint8_t, uint16_t);
+static usb_error_t ubsa_cfg_request(struct ubsa_softc *, uint8_t, uint16_t);
 static void	ubsa_cfg_set_dtr(struct ucom_softc *, uint8_t);
 static void	ubsa_cfg_set_rts(struct ucom_softc *, uint8_t);
 static void	ubsa_cfg_set_break(struct ucom_softc *, uint8_t);
@@ -343,7 +346,7 @@
 	return (0);
 }
 
-static void
+static usb_error_t
 ubsa_cfg_request(struct ubsa_softc *sc, uint8_t index, uint16_t value)
 {
 	struct usb_device_request req;
@@ -356,12 +359,13 @@
 	req.wIndex[1] = 0;
 	USETW(req.wLength, 0);
 
-	err = ucom_cfg_do_request(sc->sc_udev, &sc->sc_ucom, 
-	    &req, NULL, 0, 1000);
+	err = ucom_cfg_do_request(sc->sc_udev, &sc->sc_ucom,
+	    &req, NULL, 0, UBSA_CFG_TIMEOUT);
 	if (err) {
-		DPRINTFN(0, "device request failed, err=%s "
-		    "(ignored)\n", usbd_errstr(err));
+		DPRINTFN(0, "device request failed, err=%s\n",
+		    usbd_errstr(err));
 	}
+	return (err);
 }
 
 static void
@@ -430,7 +434,8 @@
 
 	switch (t->c_ospeed) {
 	case B0:
-		ubsa_cfg_request(sc, UBSA_REG_FLOW_CTRL, 0);
+		if (ubsa_cfg_request(sc, UBSA_REG_FLOW_CTRL, 0) != 0)
+			return;
 		ubsa_cfg_set_dtr(&sc->sc_ucom, 0);
 		ubsa_cfg_set_rts(&sc->sc_ucom, 0);
 		break;
@@ -446,7 +451,8 @@
 	case B115200:
 	case B230400:
 		value = B230400 / t->c_ospeed;
-		ubsa_cfg_request(sc, UBSA_REG_BAUDRATE, value);
+		if (ubsa_cfg_request(sc, UBSA_REG_BAUDRATE, value) != 0)
+			return;
 		break;
 	default:
 		return;
@@ -457,7 +463,8 @@
 	else
 		value = UBSA_PARITY_NONE;
 
-	ubsa_cfg_request(sc, UBSA_REG_PARITY, value);
+	if (ubsa_cfg_request(sc, UBSA_REG_PARITY, value) != 0)
+		return;
 
 	switch (t->c_cflag & CSIZE) {
 	case CS5:
@@ -475,11 +482,13 @@
 		break;
 	}
 
-	ubsa_cfg_request(sc, UBSA_REG_DATA_BITS, value);
+	if (ubsa_cfg_request(sc, UBSA_REG_DATA_BITS, value) != 0)
+		return;
 
 	value = (t->c_cflag & CSTOPB) ? 1 : 0;
 
-	ubsa_cfg_request(sc, UBSA_REG_STOP_BITS, value);
+	if (ubsa_cfg_request(sc, UBSA_REG_STOP_BITS, value) != 0)
+		return;
 
 	value = 0;
 	if (t->c_cflag & CRTSCTS)
@@ -488,7 +497,8 @@
 	if (t->c_iflag & (IXON | IXOFF))
 		value |= UBSA_FLOW_OXON | UBSA_FLOW_IXON;
 
-	ubsa_cfg_request(sc, UBSA_REG_FLOW_CTRL, value);
+	if (ubsa_cfg_request(sc, UBSA_REG_FLOW_CTRL, value) != 0)
+		return;
 }
 
 static void