⬢ DragonFlyBSD Kernel Audit
DF-5767 / fix.diff
← back to finding ↓ download raw
--- a/sys/bus/u4b/controller/ohci.c
+++ b/sys/bus/u4b/controller/ohci.c
@@ -279,11 +279,18 @@
 	 * The AMD756 requires a delay before re-reading the register,
 	 * otherwise it will occasionally report 0 ports.
 	 */
+	/* The OHCI 1.0a spec allows at most 15 downstream ports. */
+#define	OHCI_MAX_NOPORT		15
 	sc->sc_noport = 0;
 	for (i = 0; (i < 10) && (sc->sc_noport == 0); i++) {
 		usb_pause_mtx(NULL,
 		    USB_MS_TO_TICKS(OHCI_READ_DESC_DELAY));
 		sc->sc_noport = OHCI_GET_NDP(OREAD4(sc, OHCI_RH_DESCRIPTOR_A));
+		if (sc->sc_noport > OHCI_MAX_NOPORT) {
+			device_printf(sc->sc_bus.bdev, "bogus NDP=%d, "
+			    "clipping to %d\n", sc->sc_noport, OHCI_MAX_NOPORT);
+			sc->sc_noport = OHCI_MAX_NOPORT;
+		}
 	}
 
 #ifdef USB_DEBUG