From nobody Mon Aug 24 01:30:02 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hStdC63byz6q46l for ; Mon, 24 Aug 2026 01:30:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hStdC59cFz3D4m for ; Mon, 24 Aug 2026 01:30:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787535007; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2ewex6ybLb8vPwi0g/fp3H5f/AmCjMrhzlXqz8yPgg0=; b=UJuZI88nREW0tPUJ2vPozNS5mcLrtpRWCyxr+s0G/r5eyOHsF69AAusp5DKhsD3cKQtvSp Fa+0q0UHd07X2TLSyrcQ51zSf2CD+N4M39QZeCfrycHKiyAnpXrYUvTtf+zsc6iVO01caB xQKiw6wO/CMe5YGUjwHT8dUuWlNjxBVxLD/zde9AOMIay5xFbGlVpi+PoXWBK82QC1yupa 1WPD+PHYG+ru1tvWIBLmb/3LhK30iyFZjHG54DgPKiuKjo4vPbakPzPPhEHUKO4ySM42b0 PL1m73UoFfMx1w2xci748pGkBP04uJJ/HCiSarfy7B/aJZJUpvva1r4UbE7z4g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787535007; a=rsa-sha256; cv=none; b=pdUCXpdiqHN6Vocnpq2q/KxHWsapZqw7yK1Co/BukOt3iXYrEG4l6rKTZHwX6bie3kzLWx 8NAl1Vb56TNnbVpB1cwANJiiE5jYzGgg83TRNI2ZqdEsQ6N0GL2IROeADYBxhOdWElf3eG GO86AJGUukOqQBVHbMiLo6gf1opXgpyf7qz02Ujyj5fTNSJPBRnClYpt7glN3tUqdBjKyS 5BfxZ3xTCLyDHjt+DgeUu1LEdp8IcAUgmdE5yMTddqn5ElAOgL1z4G2qCre/8RO1cp6dpR rocfAKA6Jx55sLw99DYJ7/8zePl69juWEuYwg1zE5BQqPBhiTIdUe4POoDu9Lw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787535007; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=2ewex6ybLb8vPwi0g/fp3H5f/AmCjMrhzlXqz8yPgg0=; b=P1gm3EVM6FYOuEnWKthmrcTAg3rtHyp94AOCwIV9VyLOIDDp3Bw+ziXFnCeX8W5O83oObB ykEMMmzXxA/xUjmet/tQX9Jx9IqL2ZfsdLD99to+rOq2YifFTRO6ITZHzHeNDmnGg/OinO 2I0TjImUn03FIUcDdr/SarAXXK4w/hweQnM2s+EhBivG2cskiFn8+nFl6Umdw6hXNoRAZi HbCWVTOiHF98JBINuFUU9pUTr0S8jx+eWyuaaRvkIx9TgCLd7d3BaA0uwbY0FpmxB/BU8s 6+mptAR3Db7R8trBHYclzB6UQLiAv+sudp5i6E0mI/S2lRpghN+cpcvtRnoC0Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hStdC3v7wzk03 for ; Mon, 24 Aug 2026 01:30:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3695e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 24 Aug 2026 01:30:02 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: yuvrajnode From: ShengYi Hung Subject: git: fc3e8434a61f - main - libusb: Fix NULL dereference when a hotplug callback deregisters itself List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: aokblast X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: fc3e8434a61f372b4d6ec6bd8910ac8cd54b9b37 Auto-Submitted: auto-generated Date: Mon, 24 Aug 2026 01:30:02 +0000 Message-Id: <6a8b9e9a.3695e.7c5459db@gitrepo.freebsd.org> The branch main has been updated by aokblast: URL: https://cgit.FreeBSD.org/src/commit/?id=fc3e8434a61f372b4d6ec6bd8910ac8cd54b9b37 commit fc3e8434a61f372b4d6ec6bd8910ac8cd54b9b37 Author: yuvrajnode AuthorDate: 2026-08-23 07:15:49 +0000 Commit: ShengYi Hung CommitDate: 2026-08-24 01:29:52 +0000 libusb: Fix NULL dereference when a hotplug callback deregisters itself libusb_hotplug_register_callback() runs the newly registered callback over the already-enumerated device list when LIBUSB_HOTPLUG_ENUMERATE is set. A hotplug callback returning non-zero means "deregister me", and the enumerate loop honours that by freeing the handle and setting it to NULL. Since commit 6bda9f26d2ed changed libusb_hotplug_callback_handle from a pointer to an int, the tail of the function unconditionally dereferences that handle, so any caller that passes LIBUSB_HOTPLUG_ENUMERATE, a non-NULL handle pointer, and a callback that returns non-zero on a matching device crashes inside libusb. This is a normal usage pattern and it was safe before the conversion, when the equivalent line simply stored NULL. Report the reserved id 0 instead. The allocator hands out ids starting at 1, and libusb_hotplug_deregister_callback() already ignores 0, so this restores the pre-conversion behaviour. Signed-off-by: yuvrajnode Reviewed by: aokblast Fixes: 6bda9f26d2ed ("libusb: change callback register handler to int") Pull Request: https://github.com/freebsd/freebsd-src/pull/2383 Closes: https://github.com/freebsd/freebsd-src/pull/2383 --- lib/libusb/libusb10_hotplug.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/lib/libusb/libusb10_hotplug.c b/lib/libusb/libusb10_hotplug.c index 5def972c5ab5..cf8eeafabc52 100644 --- a/lib/libusb/libusb10_hotplug.c +++ b/lib/libusb/libusb10_hotplug.c @@ -408,8 +408,15 @@ int libusb_hotplug_register_callback(libusb_context *ctx, TAILQ_INSERT_TAIL(&ctx->hotplug_cbh, handle, entry); HOTPLUG_UNLOCK(ctx); + /* + * The callback may have deregistered itself during the + * LIBUSB_HOTPLUG_ENUMERATE pass above, in which case handle is + * already freed. Report the reserved id 0, which is never handed + * out by the allocator above and which + * libusb_hotplug_deregister_callback() treats as a no-op. + */ if (phandle != NULL) - *phandle = handle->id; + *phandle = (handle != NULL) ? handle->id : 0; return (LIBUSB_SUCCESS); }