Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 25 Jul 2026 02:02:12 +0000
From:      Adrian Chadd <adrian@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org
Cc:        Abdelkader Boudih <freebsd@seuros.com>
Subject:   git: 3fbffbcbec88 - main - ietp: guard iicbus_get_addr with devclass check
Message-ID:  <6a641924.38b06.1aef7f36@gitrepo.freebsd.org>

index | next in thread | raw e-mail

The branch main has been updated by adrian:

URL: https://cgit.FreeBSD.org/src/commit/?id=3fbffbcbec88932d7c7b024aca5a1e26a36f13a4

commit 3fbffbcbec88932d7c7b024aca5a1e26a36f13a4
Author:     Abdelkader Boudih <freebsd@seuros.com>
AuthorDate: 2026-07-25 01:28:44 +0000
Commit:     Adrian Chadd <adrian@FreeBSD.org>
CommitDate: 2026-07-25 02:01:54 +0000

    ietp: guard iicbus_get_addr with devclass check
    
    When a USB HID device triggers identify,
    the grandparent is usbhid on a USB hub.
    Calling iicbus_get_addr() on a non-iicbus device
    hits a KASSERT panic.
    
    Reviewed by:    adrian
    Differential Revision:  https://reviews.freebsd.org/D58432
---
 sys/dev/hid/ietp.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/sys/dev/hid/ietp.c b/sys/dev/hid/ietp.c
index a9d0295fb121..6a31423f61d8 100644
--- a/sys/dev/hid/ietp.c
+++ b/sys/dev/hid/ietp.c
@@ -450,13 +450,10 @@ ietp_iic_identify(driver_t *driver, device_t parent)
 {
 	device_t iichid = device_get_parent(parent);
 	static const uint16_t reg = IETP_PATTERN;
-	uint16_t addr = iicbus_get_addr(iichid) << 1;
+	uint16_t addr;
 	uint8_t resp[2];
 	uint8_t cmd[2] = { reg & 0xff, (reg >> 8) & 0xff };
-	struct iic_msg msgs[2] = {
-	    { addr, IIC_M_WR | IIC_M_NOSTOP,  sizeof(cmd), cmd },
-	    { addr, IIC_M_RD, sizeof(resp), resp },
-	};
+	struct iic_msg msgs[2];
 	struct iic_rdwr_data ird = { msgs, nitems(msgs) };
 	uint8_t pattern;
 
@@ -466,6 +463,10 @@ ietp_iic_identify(driver_t *driver, device_t parent)
 	if (device_get_devclass(iichid) != devclass_find("iichid"))
 		return;
 
+	addr = iicbus_get_addr(iichid) << 1;
+	msgs[0] = (struct iic_msg){ addr, IIC_M_WR | IIC_M_NOSTOP, sizeof(cmd), cmd };
+	msgs[1] = (struct iic_msg){ addr, IIC_M_RD, sizeof(resp), resp };
+
 	DPRINTF("Read reg 0x%04x with size %zu\n", reg, sizeof(resp));
 
 	if (hid_ioctl(parent, I2CRDWR, (uintptr_t)&ird) != 0)


home | help

Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a641924.38b06.1aef7f36>