Changeset 065064e6 in mainline


Ignore:
Timestamp:
2011-10-15T12:49:18Z (13 years ago)
Author:
Jan Vesely <jano.vesely@…>
Branches:
lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export
Children:
e3f7418
Parents:
7c95d6f5
Message:

usb: Add and use usb_device_data_alloc.

Inspired by ddf_dev_data_alloc and ddf_fun_data_alloc.
Fix possible double free (hid dev and hid fun shared driver_data).

Location:
uspace
Files:
10 edited

Legend:

Unmodified
Added
Removed

  • uspace/drv/bus/usb/usbhid/generic/hiddev.c

    r7c95d6f5 r065064e6  
    201201        }
    202202        usb_log_debug2("%s unbound.\n", fun->name);
     203        /* We did not allocate this, so leave this alone
     204         * the device would take care of it */
     205        fun->driver_data = NULL;
    203206        ddf_fun_destroy(fun);
    204207}
    … …  
    223226
    224227        fun->ops = &usb_generic_hid_ops;
    225         fun->driver_data = hid_dev;
    226228
    227229        int rc = ddf_fun_bind(fun);
    … …  
    232234                return rc;
    233235        }
     236        /* This is nasty both device and this function have the same
     237         * driver data, thus destruction would lead to double free */
     238        fun->driver_data = hid_dev;
    234239
    235240        usb_log_debug("HID function created. Handle: %" PRIun "\n", fun->handle);

  • uspace/drv/bus/usb/usbhid/main.c

    r7c95d6f5 r065064e6  
    7777        assert(dev != NULL);
    7878
    79         /*
    80          * Initialize device (get and process descriptors, get address, etc.)
    81          */
     79        /* Initialize device (get and process descriptors, get address, etc.) */
    8280        usb_log_debug("Initializing USB/HID device...\n");
    8381
    84         usb_hid_dev_t *hid_dev = usb_hid_new();
     82        usb_hid_dev_t *hid_dev =
     83            usb_device_data_alloc(dev, sizeof(usb_hid_dev_t));
    8584        if (hid_dev == NULL) {
    8685                usb_log_error("Error while creating USB/HID device "

  • uspace/drv/bus/usb/usbhid/usbhid.c

    r7c95d6f5 r065064e6  
    412412/*----------------------------------------------------------------------------*/
    413413
    414 usb_hid_dev_t *usb_hid_new(void)
    415 {
    416         usb_hid_dev_t *hid_dev = (usb_hid_dev_t *)calloc(1,
    417             sizeof(usb_hid_dev_t));
     414int usb_hid_init(usb_hid_dev_t *hid_dev, usb_device_t *dev)
     415{
     416        int rc, i;
     417
     418        usb_log_debug("Initializing HID structure...\n");
    418419
    419420        if (hid_dev == NULL) {
    420                 usb_log_error("No memory!\n");
    421                 return NULL;
     421                usb_log_error("Failed to init HID structure: no structure given"
     422                    ".\n");
     423                return EINVAL;
     424        }
     425
     426        if (dev == NULL) {
     427                usb_log_error("Failed to init HID structure: no USB device"
     428                    " given.\n");
     429                return EINVAL;
    422430        }
    423431
    … …  
    426434        if (hid_dev->report == NULL) {
    427435                usb_log_error("No memory!\n");
    428                 free(hid_dev);
    429                 return NULL;
    430         }
    431 
    432         hid_dev->poll_pipe_index = -1;
    433 
    434         return hid_dev;
    435 }
    436 
    437 /*----------------------------------------------------------------------------*/
    438 
    439 int usb_hid_init(usb_hid_dev_t *hid_dev, usb_device_t *dev)
    440 {
    441         int rc, i;
    442 
    443         usb_log_debug("Initializing HID structure...\n");
    444 
    445         if (hid_dev == NULL) {
    446                 usb_log_error("Failed to init HID structure: no structure given"
    447                     ".\n");
    448                 return EINVAL;
    449         }
    450 
    451         if (dev == NULL) {
    452                 usb_log_error("Failed to init HID structure: no USB device"
    453                     " given.\n");
    454                 return EINVAL;
    455         }
    456 
     436                return ENOMEM;
     437        }
    457438        usb_hid_report_init(hid_dev->report);
    458439
    459440        /* The USB device should already be initialized, save it in structure */
    460441        hid_dev->usb_dev = dev;
     442        hid_dev->poll_pipe_index = -1;
    461443
    462444        rc = usb_hid_check_pipes(hid_dev, dev);

  • uspace/drv/bus/usb/usbhid/usbhid.h

    r7c95d6f5 r065064e6  
    145145/*----------------------------------------------------------------------------*/
    146146
    147 usb_hid_dev_t *usb_hid_new(void);
    148 
    149147int usb_hid_init(usb_hid_dev_t *hid_dev, usb_device_t *dev);
    150148

  • uspace/drv/bus/usb/usbhub/usbhub.c

    r7c95d6f5 r065064e6  
    117117        ddf_fun_destroy(hub->hub_fun);
    118118
    119         free(hub);
    120         usb_dev->driver_data = NULL;
    121119        usb_log_info("USB hub driver, stopped and cleaned.\n");
    122120        return EOK;
    … …  
    254252{
    255253        assert(usb_dev);
    256         usb_hub_dev_t *hub_dev = malloc(sizeof(usb_hub_dev_t));
     254        usb_hub_dev_t *hub_dev =
     255            usb_device_data_alloc(usb_dev, sizeof(usb_hub_dev_t));
    257256        if (!hub_dev)
    258257            return NULL;
    259258
    260259        hub_dev->usb_device = usb_dev;
    261 
    262260        hub_dev->ports = NULL;
    263261        hub_dev->port_count = 0;
    … …  
    266264        fibril_mutex_initialize(&hub_dev->pending_ops_mutex);
    267265        fibril_condvar_initialize(&hub_dev->pending_ops_cv);
    268         usb_dev->driver_data = hub_dev;
    269266
    270267        return hub_dev;

  • uspace/drv/bus/usb/usbmast/main.c

    r7c95d6f5 r065064e6  
    103103        }
    104104        free(mdev->luns);
    105         free(mdev);
    106105        return EOK;
    107106}
    … …  
    119118
    120119        /* Allocate softstate */
    121         dev->driver_data = mdev = malloc(sizeof(usbmast_dev_t));
     120        mdev = usb_device_data_alloc(dev, sizeof(usbmast_dev_t));
    122121        if (mdev == NULL) {
    123122                usb_log_error("Failed allocating softstate.\n");

  • uspace/drv/bus/usb/usbmid/explore.c

    r7c95d6f5 r065064e6  
    163163        }
    164164
    165         usb_mid_t *usb_mid = malloc(sizeof(usb_mid_t));
     165        usb_mid_t *usb_mid = usb_device_data_alloc(dev, sizeof(usb_mid_t));
    166166        if (!usb_mid) {
    167167                usb_log_error("Failed to create USB MID structure.\n");
    … …  
    173173        if (usb_mid->ctl_fun == NULL) {
    174174                usb_log_error("Failed to create control function.\n");
    175                 free(usb_mid);
    176175                return false;
    177176        }
    … …  
    184183                    str_error(rc));
    185184                ddf_fun_destroy(usb_mid->ctl_fun);
    186                 free(usb_mid);
    187185                return false;
    188186        }
    … …  
    209207                }
    210208        }
    211         dev->driver_data = usb_mid;
    212209
    213210        return true;

  • uspace/drv/bus/usb/usbmid/main.c

    r7c95d6f5 r065064e6  
    103103                }
    104104        }
    105         free(usb_mid);
    106105        return ret;
    107106}

  • uspace/lib/usbdev/include/usb/dev/driver.h

    r7c95d6f5 r065064e6  
    173173int usb_device_create(ddf_dev_t *, usb_endpoint_description_t **, usb_device_t **, const char **);
    174174void usb_device_destroy(usb_device_t *);
     175void * usb_device_data_alloc(usb_device_t *, size_t);
    175176
    176177size_t usb_interface_count_alternates(const uint8_t *, size_t, uint8_t);

  • uspace/lib/usbdev/src/devdrv.c

    r7c95d6f5 r065064e6  
    152152        gen_dev->driver_data = dev;
    153153
    154         return driver->ops->device_add(dev);
     154        rc = driver->ops->device_add(dev);
     155        if (rc != EOK)
     156                usb_device_destroy(dev);
     157        return rc;
    155158}
    156159/*----------------------------------------------------------------------------*/
    … …  
    185188        if (driver->ops->device_gone == NULL)
    186189                return ENOTSUP;
    187         const int ret = driver->ops->device_gone(gen_dev->driver_data);
     190        usb_device_t *usb_dev = gen_dev->driver_data;
     191        const int ret = driver->ops->device_gone(usb_dev);
    188192        if (ret == EOK)
    189                 usb_device_destroy(gen_dev->driver_data);
     193                usb_device_destroy(usb_dev);
    190194
    191195        return ret;
    … …  
    595599
    596600        /* Ignore errors and hope for the best. */
    597         usb_device_destroy_pipes(dev->ddf_dev, dev->pipes, dev->pipes_count);
    598         free(dev->descriptors.configuration);
     601        destroy_current_pipes(dev);
    599602
    600603        if (dev->alternate_interfaces != NULL) {
    … …  
    602605        }
    603606        free(dev->alternate_interfaces);
    604 
    605         free(dev);
     607        free(dev->descriptors.configuration);
     608        free(dev->driver_data);
     609}
     610
     611void * usb_device_data_alloc(usb_device_t *usb_dev, size_t size)
     612{
     613        assert(usb_dev);
     614        assert(usb_dev->driver_data == NULL);
     615        return usb_dev->driver_data = calloc(1, size);
     616
    606617}
    607618
Note: See TracChangeset for help on using the changeset viewer.