sc->sc_ibuf should be malloc'ed after quirks applied, as

sc->sc_isize might have changed.

MFC after:   3 days

1 files changed, 7 insertions, 6 deletions

diff --git a/sys/dev/usb/ums.c b/sys/dev/usb/ums.c
index 0e7d533..a869f75 100644
--- a/sys/dev/usb/ums.c
+++ b/sys/dev/usb/ums.c
@@ -362,12 +362,6 @@ ums_attach(device_t self)
 				hid_input, &sc->sc_loc_btn[i-1], 0);
 
 	sc->sc_isize = hid_report_size(desc, size, hid_input, &sc->sc_iid);
-	sc->sc_ibuf = malloc(sc->sc_isize, M_USB, M_NOWAIT);
-	if (!sc->sc_ibuf) {
-		printf("%s: no memory\n", device_get_nameunit(sc->sc_dev));
-		free(sc->sc_loc_btn, M_USB);
-		return ENXIO;
-	}
 
 	/*
 	 * The Microsoft Wireless Notebook Optical Mouse seems to be in worse
@@ -410,6 +404,13 @@ ums_attach(device_t self)
 		sc->sc_loc_btn[2].pos = 2;
 	}
 
+	sc->sc_ibuf = malloc(sc->sc_isize, M_USB, M_NOWAIT);
+	if (!sc->sc_ibuf) {
+		printf("%s: no memory\n", device_get_nameunit(sc->sc_dev));
+		free(sc->sc_loc_btn, M_USB);
+		return ENXIO;
+	}
+
 	sc->sc_ep_addr = ed->bEndpointAddress;
 	sc->sc_disconnected = 0;
 	free(desc, M_TEMP);