From 52b6d773a9c807da2b7554e98ad4f4bab7ed6124 Mon Sep 17 00:00:00 2001
From: mpi <mpi@openbsd.org>
Date: Tue, 5 Aug 2014 20:26:15 +0000
Subject: [PATCH] Only check if the abort transfer is the interrupt one if the
 pipe is opened with a callback.

If a driver opens an interrupt pipe without callback function, like
umct(4) does with one of its bulk in endpoints being reported as an
interrupt endpoint, then we can end up aborting a transfer which is
different from the interrupt one.

Issue reported by Roberto E. Vargas Caballero, ok deraadt@
---
 sys/dev/usb/ehci.c | 4 ++--
 sys/dev/usb/ohci.c | 4 ++--
 sys/dev/usb/uhci.c | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/sys/dev/usb/ehci.c b/sys/dev/usb/ehci.c
index 05c006cb0c1..7f051acd48e 100644
--- a/sys/dev/usb/ehci.c
+++ b/sys/dev/usb/ehci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ehci.c,v 1.163 2014/08/03 14:30:28 jsg Exp $ */
+/*	$OpenBSD: ehci.c,v 1.164 2014/08/05 20:26:15 mpi Exp $ */
 /*	$NetBSD: ehci.c,v 1.66 2004/06/30 03:11:56 mycroft Exp $	*/
 
 /*
@@ -3388,7 +3388,7 @@ ehci_device_intr_start(struct usbd_xfer *xfer)
 void
 ehci_device_intr_abort(struct usbd_xfer *xfer)
 {
-	KASSERT(xfer->pipe->intrxfer == xfer);
+	KASSERT(!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer);
 
 	/*
 	 * XXX - abort_xfer uses ehci_sync_hc, which syncs via the advance
diff --git a/sys/dev/usb/ohci.c b/sys/dev/usb/ohci.c
index ef52e302e2d..f0cc91b23b8 100644
--- a/sys/dev/usb/ohci.c
+++ b/sys/dev/usb/ohci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ohci.c,v 1.136 2014/07/12 20:13:48 mpi Exp $ */
+/*	$OpenBSD: ohci.c,v 1.137 2014/08/05 20:26:15 mpi Exp $ */
 /*	$NetBSD: ohci.c,v 1.139 2003/02/22 05:24:16 tsutsui Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/ohci.c,v 1.22 1999/11/17 22:33:40 n_hibma Exp $	*/
 
@@ -2934,7 +2934,7 @@ ohci_device_intr_start(struct usbd_xfer *xfer)
 void
 ohci_device_intr_abort(struct usbd_xfer *xfer)
 {
-	KASSERT(xfer->pipe->intrxfer == xfer);
+	KASSERT(!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer);
 
 	ohci_abort_xfer(xfer, USBD_CANCELLED);
 }
diff --git a/sys/dev/usb/uhci.c b/sys/dev/usb/uhci.c
index 4c3ae9cc666..4836ecec6c5 100644
--- a/sys/dev/usb/uhci.c
+++ b/sys/dev/usb/uhci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uhci.c,v 1.128 2014/07/12 20:13:48 mpi Exp $	*/
+/*	$OpenBSD: uhci.c,v 1.129 2014/08/05 20:26:15 mpi Exp $	*/
 /*	$NetBSD: uhci.c,v 1.172 2003/02/23 04:19:26 simonb Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/uhci.c,v 1.33 1999/11/17 22:33:41 n_hibma Exp $	*/
 
@@ -1967,7 +1967,7 @@ uhci_device_ctrl_close(struct usbd_pipe *pipe)
 void
 uhci_device_intr_abort(struct usbd_xfer *xfer)
 {
-	KASSERT(xfer->pipe->intrxfer == xfer);
+	KASSERT(!xfer->pipe->repeat || xfer->pipe->intrxfer == xfer);
 
 	uhci_abort_xfer(xfer, USBD_CANCELLED);
 }
-- 
2.20.1