From: mpi <mpi@openbsd.org>
Date: Thu, 6 Sep 2018 15:39:48 +0000 (+0000)
Subject: If we cannot stop the endpoint when aborting a transfer assume that
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=c3b0c434c85589f5766311dcd86a6ca4d717aeee;p=openbsd

If we cannot stop the endpoint when aborting a transfer assume that
the device is gone and give back the descriptor to the stack.

Without this usbd_abort_pipe() could end up in an infinite loop.

Issue reported by Tom Murphy.
---

diff --git a/sys/dev/usb/xhci.c b/sys/dev/usb/xhci.c
index d326a1f0199..7209e2062ba 100644
--- a/sys/dev/usb/xhci.c
+++ b/sys/dev/usb/xhci.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: xhci.c,v 1.88 2018/09/05 14:03:28 mpi Exp $ */
+/* $OpenBSD: xhci.c,v 1.89 2018/09/06 15:39:48 mpi Exp $ */
 
 /*
  * Copyright (c) 2014-2015 Martin Pieuchot
@@ -2055,8 +2055,13 @@ xhci_abort_xfer(struct usbd_xfer *xfer, usbd_status status)
 	xp->aborted_xfer = xfer;
 
 	/* Stop the endpoint and wait until the hardware says so. */
-	if (xhci_cmd_stop_ep(sc, xp->slot, xp->dci))
+	if (xhci_cmd_stop_ep(sc, xp->slot, xp->dci)) {
 		DPRINTF(("%s: error stopping endpoint\n", DEVNAME(sc)));
+		/* Assume the device is gone. */
+		xfer->status = status;
+		usb_transfer_complete(xfer);
+		return;
+	}
 
 	/*
 	 * The transfer was already completed when we stopped the