[src/trunk]: src/sys/dev/usb Fix NULL derefs, to prevent kernel crashes when ...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2838a7b92dd9
branches:  trunk
changeset: 459506:2838a7b92dd9
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sat Sep 14 12:37:34 2019 +0000

description:
Fix NULL derefs, to prevent kernel crashes when detaching an otus0 device.

Found with vHCI.

diffstat:

 sys/dev/usb/if_otus.c |  13 +++++++++++--
 1 files changed, 11 insertions(+), 2 deletions(-)

diffs (48 lines):

diff -r dbb930ec2779 -r 2838a7b92dd9 sys/dev/usb/if_otus.c
--- a/sys/dev/usb/if_otus.c     Sat Sep 14 12:36:35 2019 +0000
+++ b/sys/dev/usb/if_otus.c     Sat Sep 14 12:37:34 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_otus.c,v 1.38 2019/05/28 07:41:50 msaitoh Exp $     */
+/*     $NetBSD: if_otus.c,v 1.39 2019/09/14 12:37:34 maxv Exp $        */
 /*     $OpenBSD: if_otus.c,v 1.18 2010/08/27 17:08:00 jsg Exp $        */
 
 /*-
@@ -23,7 +23,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_otus.c,v 1.38 2019/05/28 07:41:50 msaitoh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_otus.c,v 1.39 2019/09/14 12:37:34 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -1107,6 +1107,9 @@
 
        DPRINTFN(DBG_FN, sc, "\n");
 
+       if (sc->sc_cmd_tx_pipe == NULL)
+               return;
+
        /* Make sure no transfers are pending. */
        usbd_abort_pipe(sc->sc_cmd_tx_pipe);
 
@@ -1158,6 +1161,9 @@
 
        DPRINTFN(DBG_FN, sc, "\n");
 
+       if (sc->sc_data_tx_pipe == NULL)
+               return;
+
        /* Make sure no transfers are pending. */
        usbd_abort_pipe(sc->sc_data_tx_pipe);
 
@@ -1203,6 +1209,9 @@
 
        DPRINTFN(DBG_FN, sc, "\n");
 
+       if (sc->sc_data_rx_pipe == NULL)
+               return;
+
        /* Make sure no transfers are pending. */
        usbd_abort_pipe(sc->sc_data_rx_pipe);