From cb3b09a7e1ada9283979165fdac1e1bd3852f240 Mon Sep 17 00:00:00 2001
From: gerhard <gerhard@openbsd.org>
Date: Mon, 10 Sep 2018 17:00:45 +0000
Subject: [PATCH] Prevent a panic in umb(4) when roaming is diabled.

Found by beck@, tested and ok by bluhm@
---
 sys/dev/usb/if_umb.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/sys/dev/usb/if_umb.c b/sys/dev/usb/if_umb.c
index 7fc04eb6113..e5a48292f30 100644
--- a/sys/dev/usb/if_umb.c
+++ b/sys/dev/usb/if_umb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_umb.c,v 1.19 2018/04/30 19:07:44 tb Exp $ */
+/*	$OpenBSD: if_umb.c,v 1.20 2018/09/10 17:00:45 gerhard Exp $ */
 
 /*
  * Copyright (c) 2016 genua mbH
@@ -905,13 +905,7 @@ umb_statechg_timeout(void *arg)
 {
 	struct umb_softc *sc = arg;
 
-	if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) {
-		/*
-		 * Query the registration state until we're with the home
-		 * network again.
-		 */
-		umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, NULL, 0);
-	} else
+	if (sc->sc_info.regstate != MBIM_REGSTATE_ROAMING || sc->sc_roaming)
 		printf("%s: state change timeout\n",DEVNAM(sc));
 	usb_add_task(sc->sc_udev, &sc->sc_umb_task);
 }
@@ -944,6 +938,15 @@ umb_state_task(void *arg)
 	int	 s;
 	int	 state;
 
+	if (sc->sc_info.regstate == MBIM_REGSTATE_ROAMING && !sc->sc_roaming) {
+		/*
+		 * Query the registration state until we're with the home
+		 * network again.
+		 */
+		umb_cmd(sc, MBIM_CID_REGISTER_STATE, MBIM_CMDOP_QRY, NULL, 0);
+		return;
+	}
+
 	s = splnet();
 	if (ifp->if_flags & IFF_UP)
 		umb_up(sc);
-- 
2.20.1