⬢ DragonFlyBSD Kernel Audit
DF-5496 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
--- a/sys/bus/u4b/serial/umct.c
+++ b/sys/bus/u4b/serial/umct.c
@@ -80,6 +80,9 @@
 #define	UMCT_SET_MCR		10	/* Set Modem Control Register */
 #define	UMCT_SET_MCR_SIZE	1
 
+/* bounded timeout for cfg-path (tty ioctl / open / close) EP0 requests */
+#define	UMCT_CFG_TIMEOUT	250	/* ms */
+
 #define	UMCT_INTR_INTERVAL	100
 #define	UMCT_IFACE_INDEX	0
 #define	UMCT_CONFIG_INDEX	0
@@ -124,8 +127,8 @@
 static usb_callback_t umct_read_callback_sub;
 static usb_callback_t umct_write_callback;
 
-static void	umct_cfg_do_request(struct umct_softc *sc, uint8_t request,
-		    uint16_t len, uint32_t value);
+static usb_error_t umct_cfg_do_request(struct umct_softc *sc,
+		    uint8_t request, uint16_t len, uint32_t value);
 static void	umct_cfg_get_status(struct ucom_softc *, uint8_t *,
 		    uint8_t *);
 static void	umct_cfg_set_break(struct ucom_softc *, uint8_t);
@@ -311,7 +314,7 @@
 	return (0);
 }
 
-static void
+static usb_error_t
 umct_cfg_do_request(struct umct_softc *sc, uint8_t request,
     uint16_t len, uint32_t value)
 {
@@ -329,13 +332,13 @@
 	USETW(req.wLength, len);
 	USETDW(temp, value);
 
-	err = ucom_cfg_do_request(sc->sc_udev, &sc->sc_ucom, 
-	    &req, temp, 0, 1000);
+	err = ucom_cfg_do_request(sc->sc_udev, &sc->sc_ucom,
+	    &req, temp, 0, UMCT_CFG_TIMEOUT);
 	if (err) {
-		DPRINTFN(0, "device request failed, err=%s "
-		    "(ignored)\n", usbd_errstr(err));
+		DPRINTFN(0, "device request failed, err=%s\n",
+		    usbd_errstr(err));
 	}
-	return;
+	return (err);
 }
 
 static void
@@ -397,7 +400,9 @@
 	else
 		sc->sc_lcr &= ~0x40;
 
-	umct_cfg_do_request(sc, UMCT_SET_LCR, UMCT_SET_LCR_SIZE, sc->sc_lcr);
+	if (umct_cfg_do_request(sc, UMCT_SET_LCR, UMCT_SET_LCR_SIZE,
+	    sc->sc_lcr) != 0)
+		return;
 }
 
 static void
@@ -410,7 +415,9 @@
 	else
 		sc->sc_mcr &= ~0x01;
 
-	umct_cfg_do_request(sc, UMCT_SET_MCR, UMCT_SET_MCR_SIZE, sc->sc_mcr);
+	if (umct_cfg_do_request(sc, UMCT_SET_MCR, UMCT_SET_MCR_SIZE,
+	    sc->sc_mcr) != 0)
+		return;
 }
 
 static void
@@ -423,7 +430,9 @@
 	else
 		sc->sc_mcr &= ~0x02;
 
-	umct_cfg_do_request(sc, UMCT_SET_MCR, UMCT_SET_MCR_SIZE, sc->sc_mcr);
+	if (umct_cfg_do_request(sc, UMCT_SET_MCR, UMCT_SET_MCR_SIZE,
+	    sc->sc_mcr) != 0)
+		return;
 }
 
 static uint8_t
@@ -469,7 +478,9 @@
 	uint32_t value;
 
 	value = umct_calc_baud(t->c_ospeed);
-	umct_cfg_do_request(sc, UMCT_SET_BAUD, UMCT_SET_BAUD_SIZE, value);
+	if (umct_cfg_do_request(sc, UMCT_SET_BAUD, UMCT_SET_BAUD_SIZE,
+	    value) != 0)
+		return;
 
 	value = (sc->sc_lcr & 0x40);