From d35f0cf48ac69771f396ce280a53bddb6b862139 Mon Sep 17 00:00:00 2001
From: visa <visa@openbsd.org>
Date: Mon, 19 Dec 2022 15:10:40 +0000
Subject: [PATCH] Invalidate ugen(4) knote lists after device detach

This prevents the kernel from crashing when a ugen(4) device is detached
while kqueue still holds a reference to that device.

Crash reported and fix tested by xavier.s on bugs@.

OK mpi@
---
 sys/dev/usb/ugen.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sys/dev/usb/ugen.c b/sys/dev/usb/ugen.c
index bf82f843e9f..194a39a8792 100644
--- a/sys/dev/usb/ugen.c
+++ b/sys/dev/usb/ugen.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ugen.c,v 1.116 2022/07/02 08:50:42 visa Exp $ */
+/*	$OpenBSD: ugen.c,v 1.117 2022/12/19 15:10:40 visa Exp $ */
 /*	$NetBSD: ugen.c,v 1.63 2002/11/26 18:49:48 christos Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/ugen.c,v 1.26 1999/11/17 22:33:41 n_hibma Exp $	*/
 
@@ -798,6 +798,10 @@ ugen_detach(struct device *self, int flags)
 	for (endptno = 0; endptno < USB_MAX_ENDPOINTS; endptno++) {
 		if (sc->sc_is_open[endptno])
 			ugen_do_close(sc, endptno, FREAD|FWRITE);
+
+		/* ugenkqfilter() always uses IN. */
+		sce = &sc->sc_endpoints[endptno][IN];
+		klist_invalidate(&sce->rsel.si_note);
 	}
 	return (0);
 }
-- 
2.20.1