Only check if the abort transfer is the interrupt one if the pipe is

opened with a callback.

If a driver opens an interrupt pipe without callback function, like
umct(4) does with one of its bulk in endpoints being reported as an
interrupt endpoint, then we can end up aborting a transfer which is
different from the interrupt one.

Issue reported by Roberto E. Vargas Caballero, ok deraadt@

diff --git a/sys/dev/usb/ehci.c b/sys/dev/usb/ehci.c
index 05c006c..7f051ac 100644 (file)
--- a/sys/dev/usb/ehci.c
+++ b/sys/dev/usb/ehci.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ehci.c,v 1.163 2014/08/03 14:30:28 jsg Exp $ */
+/*     $OpenBSD: ehci.c,v 1.164 2014/08/05 20:26:15 mpi Exp $ */
 /*     $NetBSD: ehci.c,v 1.66 2004/06/30 03:11:56 mycroft Exp $        */
 
 /*
@@ -3388,7 +3388,7 @@ ehci_device_intr_start(struct usbd_xfer *xfer)
 void
 ehci_device_intr_abort(struct usbd_xfer *xfer)
 {
-       KASSERT(xfer->pipe->intrxfer == xfer);
+       KASSERT(!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer);
 
        /*
         * XXX - abort_xfer uses ehci_sync_hc, which syncs via the advance

diff --git a/sys/dev/usb/ohci.c b/sys/dev/usb/ohci.c
index ef52e30..f0cc91b 100644 (file)
--- a/sys/dev/usb/ohci.c
+++ b/sys/dev/usb/ohci.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ohci.c,v 1.136 2014/07/12 20:13:48 mpi Exp $ */
+/*     $OpenBSD: ohci.c,v 1.137 2014/08/05 20:26:15 mpi Exp $ */
 /*     $NetBSD: ohci.c,v 1.139 2003/02/22 05:24:16 tsutsui Exp $       */
 /*     $FreeBSD: src/sys/dev/usb/ohci.c,v 1.22 1999/11/17 22:33:40 n_hibma Exp $       */
 
@@ -2934,7 +2934,7 @@ ohci_device_intr_start(struct usbd_xfer *xfer)
 void
 ohci_device_intr_abort(struct usbd_xfer *xfer)
 {
-       KASSERT(xfer->pipe->intrxfer == xfer);
+       KASSERT(!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer);
 
        ohci_abort_xfer(xfer, USBD_CANCELLED);
 }

diff --git a/sys/dev/usb/uhci.c b/sys/dev/usb/uhci.c
index 4c3ae9c..4836ece 100644 (file)
--- a/sys/dev/usb/uhci.c
+++ b/sys/dev/usb/uhci.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: uhci.c,v 1.128 2014/07/12 20:13:48 mpi Exp $  */
+/*     $OpenBSD: uhci.c,v 1.129 2014/08/05 20:26:15 mpi Exp $  */
 /*     $NetBSD: uhci.c,v 1.172 2003/02/23 04:19:26 simonb Exp $        */
 /*     $FreeBSD: src/sys/dev/usb/uhci.c,v 1.33 1999/11/17 22:33:41 n_hibma Exp $       */
 
@@ -1967,7 +1967,7 @@ uhci_device_ctrl_close(struct usbd_pipe *pipe)
 void
 uhci_device_intr_abort(struct usbd_xfer *xfer)
 {
-       KASSERT(xfer->pipe->intrxfer == xfer);
+       KASSERT(!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer);
 
        uhci_abort_xfer(xfer, USBD_CANCELLED);
 }