kern/43820: usbd_device2interface_handle : returned iface could be ifaceno + 1

[sfisher%cradlepoint.com@localhost]

>Number:         43820
>Category:       kern
>Synopsis:       usbd_device2interface_handle : returned iface could be ifaceno 
>+ 1
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 30 20:25:00 +0000 2010
>Originator:     Shawn Fisher
>Release:        5.0.2
>Organization:
Cradlepoint
>Environment:
NetBSD  5.0.2 NetBSD 5.0.2 (XXX) #69: Mon Aug 30 13:57:03 MDT 2010
>Description:
usbd_device2interface_handle returns an index of the interface you want.  This 
usually works well until you run into a device that doesn't index the 
interfaces properly (sierra wireless).  An example would be a device that 
indexes the interfaces as 0,1,3,4,...N and asking for iface index 3, currently 
the function would return iface 4.  A fix would be to iterate through the 
ifaces stopping on the iface requested by ifaceno.
>How-To-Repeat:

>Fix:
Check the actual interface number against the number you are requesting.  Patch:

Index: sys/dev/usb/usbdi.c
===================================================================
--- sys/dev/usb/usbdi.c (revision 2355)
+++ sys/dev/usb/usbdi.c (working copy)
@@ -620,11 +620,25 @@
 usbd_device2interface_handle(usbd_device_handle dev,
                             u_int8_t ifaceno, usbd_interface_handle *iface)
 {
+       u_int8_t niface;
+       usbd_status err;
+       int i;
+
        if (dev->cdesc == NULL)
                return (USBD_NOT_CONFIGURED);
        if (ifaceno >= dev->cdesc->bNumInterface)
                return (USBD_INVAL);
-       *iface = &dev->ifaces[ifaceno];
+       err = usbd_interface_count(dev, &niface);
+       if (err)
+               return (err);
+       for (i=0; i < niface; i++) {
+               if (dev->ifaces[i].idesc->bInterfaceNumber == ifaceno) {
+                       *iface = &dev->ifaces[i];
+                       goto found;
+               }
+       }
+       return (USBD_INVAL);
+found:
        return (USBD_NORMAL_COMPLETION);
 }