From 34e6983c0328b2fe5fce992dfc159e81cc5910ff Mon Sep 17 00:00:00 2001 From: Martin Pieuchot Date: Thu, 6 Sep 2018 15:39:49 +0000 Subject: If we cannot stop the endpoint when aborting a transfer assume that the device is gone and give back the descriptor to the stack. Without this usbd_abort_pipe() could end up in an infinite loop. Issue reported by Tom Murphy. --- sys/dev/usb/xhci.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'sys/dev/usb') diff --git a/sys/dev/usb/xhci.c b/sys/dev/usb/xhci.c index d326a1f0199..7209e2062ba 100644 --- a/sys/dev/usb/xhci.c +++ b/sys/dev/usb/xhci.c @@ -1,4 +1,4 @@ -/* $OpenBSD: xhci.c,v 1.88 2018/09/05 14:03:28 mpi Exp $ */ +/* $OpenBSD: xhci.c,v 1.89 2018/09/06 15:39:48 mpi Exp $ */ /* * Copyright (c) 2014-2015 Martin Pieuchot @@ -2055,8 +2055,13 @@ xhci_abort_xfer(struct usbd_xfer *xfer, usbd_status status) xp->aborted_xfer = xfer; /* Stop the endpoint and wait until the hardware says so. */ - if (xhci_cmd_stop_ep(sc, xp->slot, xp->dci)) + if (xhci_cmd_stop_ep(sc, xp->slot, xp->dci)) { DPRINTF(("%s: error stopping endpoint\n", DEVNAME(sc))); + /* Assume the device is gone. */ + xfer->status = status; + usb_transfer_complete(xfer); + return; + } /* * The transfer was already completed when we stopped the -- cgit v1.2.3