[src/trunk]: src/sys/dev/usb Fix panic when detach or "ifconfig down" for axe...

[rin <rin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/20c2e42b98c8
branches:  trunk
changeset: 448638:20c2e42b98c8
user:      rin <rin%NetBSD.org@localhost>
date:      Wed Feb 06 08:16:49 2019 +0000

description:
Fix panic when detach or "ifconfig down" for axen(4) and mue(4).
- Mitigate race conditions, that become critical when multiple outstanding
  transfers are enabled.
- Drop link flags earlier in foo_stop() to make sure (paranoia).

diffstat:

 sys/dev/usb/if_axen.c |  12 ++++++++----
 sys/dev/usb/if_mue.c  |  12 ++++++++----
 2 files changed, 16 insertions(+), 8 deletions(-)

diffs (108 lines):

diff -r 1103d7196862 -r 20c2e42b98c8 sys/dev/usb/if_axen.c
--- a/sys/dev/usb/if_axen.c     Wed Feb 06 08:06:59 2019 +0000
+++ b/sys/dev/usb/if_axen.c     Wed Feb 06 08:16:49 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_axen.c,v 1.33 2019/02/06 08:06:59 rin Exp $ */
+/*     $NetBSD: if_axen.c,v 1.34 2019/02/06 08:16:49 rin Exp $ */
 /*     $OpenBSD: if_axen.c,v 1.3 2013/10/21 10:10:22 yuo Exp $ */
 
 /*
@@ -23,7 +23,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.33 2019/02/06 08:06:59 rin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_axen.c,v 1.34 2019/02/06 08:16:49 rin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -1021,6 +1021,8 @@
                return;
 
        if (status != USBD_NORMAL_COMPLETION) {
+               if (status == USBD_INVAL)
+                       return; /* XXX plugged out or down */
                if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
                        return;
                if (usbd_ratecheck(&sc->axen_rx_notice)) {
@@ -1322,6 +1324,9 @@
        memcpy(c->axen_buf, &hdr, sizeof(hdr));
        m_copydata(m, 0, m->m_pkthdr.len, c->axen_buf + sizeof(hdr));
 
+       if (__predict_false(c->axen_xfer == NULL))
+               return EIO;     /* XXX plugged out or down */
+
        usbd_setup_xfer(c->axen_xfer, c, c->axen_buf, length,
            USBD_FORCE_SHORT_XFER, 10000, axen_txeof);
 
@@ -1581,6 +1586,7 @@
        ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 
        callout_stop(&sc->axen_stat_ch);
+       sc->axen_link = 0;
 
        /* Stop transfers. */
        if (sc->axen_ep[AXEN_ENDPT_RX] != NULL) {
@@ -1653,8 +1659,6 @@
                }
                sc->axen_ep[AXEN_ENDPT_INTR] = NULL;
        }
-
-       sc->axen_link = 0;
 }
 
 MODULE(MODULE_CLASS_DRIVER, if_axen, NULL);
diff -r 1103d7196862 -r 20c2e42b98c8 sys/dev/usb/if_mue.c
--- a/sys/dev/usb/if_mue.c      Wed Feb 06 08:06:59 2019 +0000
+++ b/sys/dev/usb/if_mue.c      Wed Feb 06 08:16:49 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_mue.c,v 1.31 2019/02/03 13:11:07 mlelstv Exp $      */
+/*     $NetBSD: if_mue.c,v 1.32 2019/02/06 08:16:49 rin Exp $  */
 /*     $OpenBSD: if_mue.c,v 1.3 2018/08/04 16:42:46 jsg Exp $  */
 
 /*
@@ -20,7 +20,7 @@
 /* Driver for Microchip LAN7500/LAN7800 chipsets. */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_mue.c,v 1.31 2019/02/03 13:11:07 mlelstv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_mue.c,v 1.32 2019/02/06 08:16:49 rin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_usb.h"
@@ -1267,6 +1267,9 @@
        memcpy(c->mue_buf, &hdr, sizeof(hdr)); 
        m_copydata(m, 0, len, c->mue_buf + sizeof(hdr));
 
+       if (__predict_false(c->mue_xfer == NULL))
+               return EIO;     /* XXX plugged out or down */
+
        usbd_setup_xfer(c->mue_xfer, c, c->mue_buf, len + sizeof(hdr),
            USBD_FORCE_SHORT_XFER, 10000, mue_txeof);
 
@@ -1471,6 +1474,8 @@
 
        if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
                DPRINTF(sc, "%s\n", usbd_errstr(status));
+               if (status == USBD_INVAL)
+                       return; /* XXX plugged out or down */
                if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
                        return;
                if (usbd_ratecheck(&sc->mue_rx_notice))
@@ -1833,6 +1838,7 @@
        ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 
        callout_stop(&sc->mue_stat_ch);
+       sc->mue_link = 0;
 
         /* Stop transfers. */
        for (i = 0; i < __arraycount(sc->mue_ep); i++)
@@ -1869,8 +1875,6 @@
                        sc->mue_ep[i] = NULL;
                }
 
-       sc->mue_link = 0; /* XXX */
-
        DPRINTF(sc, "done\n");
 }