Module Name: src
Committed By: rin
Date: Wed Feb 6 08:16:49 UTC 2019
Modified Files:
src/sys/dev/usb: if_axen.c if_mue.c
Log Message:
Fix panic when detach or "ifconfig down" for axen(4) and mue(4).
- Mitigate race conditions, that become critical when multiple outstanding
transfers are enabled.
- Drop link flags earlier in foo_stop() to make sure (paranoia).
To generate a diff of this commit:
cvs rdiff -u -r1.33 -r1.34 src/sys/dev/usb/if_axen.c
cvs rdiff -u -r1.31 -r1.32 src/sys/dev/usb/if_mue.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/usb/if_axen.c
diff -u src/sys/dev/usb/if_axen.c:1.33 src/sys/dev/usb/if_axen.c:1.34
--- src/sys/dev/usb/if_axen.c:1.33 Wed Feb 6 08:06:59 2019
+++ src/sys/dev/usb/if_axen.c Wed Feb 6 08:16:49 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: if_axen.c,v 1.33 2019/02/06 08:06:59 rin Exp $ */
+/* $NetBSD: if_axen.c,v 1.34 2019/02/06 08:16:49 rin Exp $ */
/* $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */
/*
@@ -23,7 +23,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.33 2019/02/06 08:06:59 rin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.34 2019/02/06 08:16:49 rin Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@@ -1021,6 +1021,8 @@ axen_rxeof(struct usbd_xfer *xfer, void
return;
if (status != USBD_NORMAL_COMPLETION) {
+ if (status == USBD_INVAL)
+ return; /* XXX plugged out or down */
if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
return;
if (usbd_ratecheck(&sc->axen_rx_notice)) {
@@ -1322,6 +1324,9 @@ axen_encap(struct axen_softc *sc, struct
memcpy(c->axen_buf, &hdr, sizeof(hdr));
m_copydata(m, 0, m->m_pkthdr.len, c->axen_buf + sizeof(hdr));
+ if (__predict_false(c->axen_xfer == NULL))
+ return EIO; /* XXX plugged out or down */
+
usbd_setup_xfer(c->axen_xfer, c, c->axen_buf, length,
USBD_FORCE_SHORT_XFER, 10000, axen_txeof);
@@ -1581,6 +1586,7 @@ axen_stop(struct ifnet *ifp, int disable
ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
callout_stop(&sc->axen_stat_ch);
+ sc->axen_link = 0;
/* Stop transfers. */
if (sc->axen_ep[AXEN_ENDPT_RX] != NULL) {
@@ -1653,8 +1659,6 @@ axen_stop(struct ifnet *ifp, int disable
}
sc->axen_ep[AXEN_ENDPT_INTR] = NULL;
}
-
- sc->axen_link = 0;
}
MODULE(MODULE_CLASS_DRIVER, if_axen, NULL);
Index: src/sys/dev/usb/if_mue.c
diff -u src/sys/dev/usb/if_mue.c:1.31 src/sys/dev/usb/if_mue.c:1.32
--- src/sys/dev/usb/if_mue.c:1.31 Sun Feb 3 13:11:07 2019
+++ src/sys/dev/usb/if_mue.c Wed Feb 6 08:16:49 2019
@@ -1,4 +1,4 @@
-/* $NetBSD: if_mue.c,v 1.31 2019/02/03 13:11:07 mlelstv Exp $ */
+/* $NetBSD: if_mue.c,v 1.32 2019/02/06 08:16:49 rin Exp $ */
/* $OpenBSD: if_mue.c,v 1.3 2018/08/04 16:42:46 jsg Exp $ */
/*
@@ -20,7 +20,7 @@
/* Driver for Microchip LAN7500/LAN7800 chipsets. */
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_mue.c,v 1.31 2019/02/03 13:11:07 mlelstv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_mue.c,v 1.32 2019/02/06 08:16:49 rin Exp $");
#ifdef _KERNEL_OPT
#include "opt_usb.h"
@@ -1267,6 +1267,9 @@ mue_encap(struct mue_softc *sc, struct m
memcpy(c->mue_buf, &hdr, sizeof(hdr));
m_copydata(m, 0, len, c->mue_buf + sizeof(hdr));
+ if (__predict_false(c->mue_xfer == NULL))
+ return EIO; /* XXX plugged out or down */
+
usbd_setup_xfer(c->mue_xfer, c, c->mue_buf, len + sizeof(hdr),
USBD_FORCE_SHORT_XFER, 10000, mue_txeof);
@@ -1471,6 +1474,8 @@ mue_rxeof(struct usbd_xfer *xfer, void *
if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
DPRINTF(sc, "%s\n", usbd_errstr(status));
+ if (status == USBD_INVAL)
+ return; /* XXX plugged out or down */
if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
return;
if (usbd_ratecheck(&sc->mue_rx_notice))
@@ -1833,6 +1838,7 @@ mue_stop(struct ifnet *ifp, int disable
ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
callout_stop(&sc->mue_stat_ch);
+ sc->mue_link = 0;
/* Stop transfers. */
for (i = 0; i < __arraycount(sc->mue_ep); i++)
@@ -1869,8 +1875,6 @@ mue_stop(struct ifnet *ifp, int disable
sc->mue_ep[i] = NULL;
}
- sc->mue_link = 0; /* XXX */
-
DPRINTF(sc, "done\n");
}
