git: 3fbffbcbec88 - main - ietp: guard iicbus_get_addr with devclass check
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 25 Jul 2026 02:02:12 UTC
The branch main has been updated by adrian:
URL: https://cgit.FreeBSD.org/src/commit/?id=3fbffbcbec88932d7c7b024aca5a1e26a36f13a4
commit 3fbffbcbec88932d7c7b024aca5a1e26a36f13a4
Author: Abdelkader Boudih <freebsd@seuros.com>
AuthorDate: 2026-07-25 01:28:44 +0000
Commit: Adrian Chadd <adrian@FreeBSD.org>
CommitDate: 2026-07-25 02:01:54 +0000
ietp: guard iicbus_get_addr with devclass check
When a USB HID device triggers identify,
the grandparent is usbhid on a USB hub.
Calling iicbus_get_addr() on a non-iicbus device
hits a KASSERT panic.
Reviewed by: adrian
Differential Revision: https://reviews.freebsd.org/D58432
---
sys/dev/hid/ietp.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/sys/dev/hid/ietp.c b/sys/dev/hid/ietp.c
index a9d0295fb121..6a31423f61d8 100644
--- a/sys/dev/hid/ietp.c
+++ b/sys/dev/hid/ietp.c
@@ -450,13 +450,10 @@ ietp_iic_identify(driver_t *driver, device_t parent)
{
device_t iichid = device_get_parent(parent);
static const uint16_t reg = IETP_PATTERN;
- uint16_t addr = iicbus_get_addr(iichid) << 1;
+ uint16_t addr;
uint8_t resp[2];
uint8_t cmd[2] = { reg & 0xff, (reg >> 8) & 0xff };
- struct iic_msg msgs[2] = {
- { addr, IIC_M_WR | IIC_M_NOSTOP, sizeof(cmd), cmd },
- { addr, IIC_M_RD, sizeof(resp), resp },
- };
+ struct iic_msg msgs[2];
struct iic_rdwr_data ird = { msgs, nitems(msgs) };
uint8_t pattern;
@@ -466,6 +463,10 @@ ietp_iic_identify(driver_t *driver, device_t parent)
if (device_get_devclass(iichid) != devclass_find("iichid"))
return;
+ addr = iicbus_get_addr(iichid) << 1;
+ msgs[0] = (struct iic_msg){ addr, IIC_M_WR | IIC_M_NOSTOP, sizeof(cmd), cmd };
+ msgs[1] = (struct iic_msg){ addr, IIC_M_RD, sizeof(resp), resp };
+
DPRINTF("Read reg 0x%04x with size %zu\n", reg, sizeof(resp));
if (hid_ioctl(parent, I2CRDWR, (uintptr_t)&ird) != 0)