If we cannot stop the endpoint when aborting a transfer assume that

the device is gone and give back the descriptor to the stack.

Without this usbd_abort_pipe() could end up in an infinite loop.

Issue reported by Tom Murphy.

diff --git a/sys/dev/usb/xhci.c b/sys/dev/usb/xhci.c
index d326a1f..7209e20 100644 (file)
--- a/sys/dev/usb/xhci.c
+++ b/sys/dev/usb/xhci.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: xhci.c,v 1.88 2018/09/05 14:03:28 mpi Exp $ */
+/* $OpenBSD: xhci.c,v 1.89 2018/09/06 15:39:48 mpi Exp $ */
 
 /*
  * Copyright (c) 2014-2015 Martin Pieuchot
@@ -2055,8 +2055,13 @@ xhci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
        xp->aborted_xfer = xfer;
 
        /* Stop the endpoint and wait until the hardware says so. */
-       if (xhci_cmd_stop_ep(sc, xp->slot, xp->dci))
+       if (xhci_cmd_stop_ep(sc, xp->slot, xp->dci)) {
                DPRINTF(("%s: error stopping endpoint\n", DEVNAME(sc)));
+               /* Assume the device is gone. */
+               xfer->status = status;
+               usb_transfer_complete(xfer);
+               return;
+       }
 
        /*
         * The transfer was already completed when we stopped the