Instead of setting the configuration in the *match() routine let the stack do it for us. This operation can fail, so it's better to not attach any driver if something bad happens.
This change is similar to what I did with the rest of the drivers some years ago when I fuzzed the stack. I'm looking for tests and oks. Index: if_kue.c =================================================================== RCS file: /cvs/src/sys/dev/usb/if_kue.c,v retrieving revision 1.89 diff -u -p -r1.89 if_kue.c --- if_kue.c 2 Oct 2018 19:49:10 -0000 1.89 +++ if_kue.c 18 Nov 2018 16:53:02 -0000 @@ -389,9 +389,7 @@ kue_match(struct device *parent, void *m { struct usb_attach_arg *uaa = aux; - DPRINTFN(25,("kue_match: enter\n")); - - if (uaa->iface != NULL) + if (uaa->iface == NULL || uaa->configno != KUE_CONFIG_NO) return (UMATCH_NONE); return (usb_lookup(kue_devs, uaa->vendor, uaa->product) != NULL ? @@ -405,7 +403,7 @@ kue_attachhook(struct device *self) int s; struct ifnet *ifp; struct usbd_device *dev = sc->kue_udev; - struct usbd_interface *iface; + struct usbd_interface *iface = sc->kue_iface; usbd_status err; usb_interface_descriptor_t *id; usb_endpoint_descriptor_t *ed; @@ -418,14 +416,6 @@ kue_attachhook(struct device *self) return; } - err = usbd_device2interface_handle(dev, KUE_IFACE_IDX, &iface); - if (err) { - printf("%s: getting interface handle failed\n", - sc->kue_dev.dv_xname); - return; - } - - sc->kue_iface = iface; id = usbd_get_interface_descriptor(iface); /* Find endpoints. */ @@ -510,20 +500,13 @@ kue_attach(struct device *parent, struct struct kue_softc *sc = (struct kue_softc *)self; struct usb_attach_arg *uaa = aux; struct usbd_device *dev = uaa->device; - usbd_status err; DPRINTFN(5,(" : kue_attach: sc=%p, dev=%p", sc, dev)); - err = usbd_set_config_no(dev, KUE_CONFIG_NO, 1); - if (err) { - printf("%s: setting config no failed\n", - sc->kue_dev.dv_xname); - return; - } - sc->kue_udev = dev; sc->kue_product = uaa->product; sc->kue_vendor = uaa->vendor; + sc->kue_iface = uaa->iface; config_mountroot(self, kue_attachhook); }