From nobody Mon Aug 24 01:30:03 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hStd762kSz6q3f7 for ; Mon, 24 Aug 2026 01:30:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hStd75VDqz3D6S for ; Mon, 24 Aug 2026 01:30:03 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787535003; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WlNtnSkuR7XNLRD+Oaa3Vt8mUXyWFNhHGLPPaZOS9Ks=; b=E5HVidKAoBtliinJpcHd8tlsN/Jv/LhFWQyXU07no1+D/A/2C31RrsJQ2IrXhYmuOXDjER CeQSWZuHwCLcy5fzmLsGR3VC+/8J6crMFaZLLPrdnBkbA3yblpcdZ1DJkvtIm2pkEYzeZf G1GQJ9uV6Q4mxYnayNr/pty4JFdjKlPdUhOXWLVnx9ecrvFj48luiGjJYG9O6QJ6/X/Mv/ n+Ffdv7Tv1hb3+5gGL4l9DXFCUUTD1bz+8wRoF5qqw2mHdfxtATFyxW+NnjeDf+0yJTL+M gNUGenGaEXRGn/CH3m7e2x7F9J3rEeWyqY22prjpg9RVRuKDQQeVfxOSKCinPA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787535003; a=rsa-sha256; cv=none; b=Acy5Ik56DNNcz0zhgXKtZqoB4QiFOCW6lrugb3/cIBdGIwM/MjesGuGCXjyeezmx3QZFM6 U/G+nhtLYnw2DGzO+7LQDUGhxyCEI/8iwj4thAhdmf56UGBbXHj8MgjKeWVFrZMZ8t0lvo pqoXhmUEeYmiQOZr07ZFtSTaHJ83L2/PVlGBo3Lq7eYsRBrA4DCjcdH+uSDWEm9yOSI9pb flI+m8O7H6tBDt6W1YK5h7eVZ1odDT3OoUa/VlJEbQcnu2MiNsUgarrg89u6IUaS3R/M6z sbDXvMaMKcisZlYArw7ProzlbtMDtO/H5OrYdi3ZvrF8BTmmaV+U6bIxkBGpdA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787535003; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WlNtnSkuR7XNLRD+Oaa3Vt8mUXyWFNhHGLPPaZOS9Ks=; b=nrX7z4dOKfM/De8w/cZIg8oDl1OZcuw9k9ZE9vTcwEdAN/9TWMT8aHjAPpoPiZV4DPQ0+T IP34cHXxaIUFGPPxYcDdqmPj9tiZo8HuDoL0/GciDSUhZltFGUSZ19xnExM6fxiuNXBvHv qbS+8rYwwfNeb6esRtkigYP7MkYQTrWLrjTH6n4hFtxTKe6mX9FgKEIYjga71cxwzP0GBm iEJrh67c2ePeh93K6Xf0Cvggo/Ztle/7gMnDPnUMtdE/4M83TQ7kpHtOCdmWoRh8Y0lua6 qBFTov+iS5Y+Z5gJa/FGlO9KrcPhDXxAh5SSo2v/87wJriffOzHyk9/dSc6T6Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hStd74GdKzk00 for ; Mon, 24 Aug 2026 01:30:03 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3615a by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 24 Aug 2026 01:30:03 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: yuvrajnode From: ShengYi Hung Subject: git: 1c2263b68397 - main - libusb: Validate arguments before dereferencing the hotplug context List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: aokblast X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 1c2263b683977ebab3d9a6448268ad810ceeec70 Auto-Submitted: auto-generated Date: Mon, 24 Aug 2026 01:30:03 +0000 Message-Id: <6a8b9e9b.3615a.68f2c82f@gitrepo.freebsd.org> The branch main has been updated by aokblast: URL: https://cgit.FreeBSD.org/src/commit/?id=1c2263b683977ebab3d9a6448268ad810ceeec70 commit 1c2263b683977ebab3d9a6448268ad810ceeec70 Author: yuvrajnode AuthorDate: 2026-08-23 07:15:49 +0000 Commit: ShengYi Hung CommitDate: 2026-08-24 01:29:52 +0000 libusb: Validate arguments before dereferencing the hotplug context libusb_hotplug_register_callback() resolves its context with GET_CONTEXT() and then immediately reads ctx->no_discovery and ctx->usb_event_mode, but only checks "ctx == NULL" afterwards. GET_CONTEXT() falls back to usbi_default_context, which is NULL before libusb_init() and is reset to NULL by libusb_exit(). An application that calls libusb_hotplug_register_callback(NULL, ...) without an initialised default context therefore crashes on the ctx->no_discovery read, instead of getting the LIBUSB_ERROR_INVALID_PARAM the existing guard was clearly written to return. Move the argument validation ahead of the first dereference. None of the validated arguments depend on the context, so no other ordering constraint is affected. Signed-off-by: yuvrajnode Reviewed by: aokblast MFC after: 2 weeks Pull Request: https://github.com/freebsd/freebsd-src/pull/2384 Closes: https://github.com/freebsd/freebsd-src/pull/2384 --- lib/libusb/libusb10_hotplug.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/libusb/libusb10_hotplug.c b/lib/libusb/libusb10_hotplug.c index cf8eeafabc52..f03c1b48b8dc 100644 --- a/lib/libusb/libusb10_hotplug.c +++ b/lib/libusb/libusb10_hotplug.c @@ -348,6 +348,12 @@ int libusb_hotplug_register_callback(libusb_context *ctx, ctx = GET_CONTEXT(ctx); + if (ctx == NULL || cb_fn == NULL || events == 0 || + vendor_id < -1 || vendor_id > 0xffff || + product_id < -1 || product_id > 0xffff || + dev_class < -1 || dev_class > 0xff) + return (LIBUSB_ERROR_INVALID_PARAM); + if (ctx->no_discovery) return (LIBUSB_SUCCESS); @@ -358,12 +364,6 @@ int libusb_hotplug_register_callback(libusb_context *ctx, HOTPLUG_UNLOCK(ctx); } - if (ctx == NULL || cb_fn == NULL || events == 0 || - vendor_id < -1 || vendor_id > 0xffff || - product_id < -1 || product_id > 0xffff || - dev_class < -1 || dev_class > 0xff) - return (LIBUSB_ERROR_INVALID_PARAM); - handle = malloc(sizeof(*handle)); if (handle == NULL) return (LIBUSB_ERROR_NO_MEM);