[src/trunk]: src/sys/dev/usb PR/52553 Panic on "ifconfig athn0 up"

[skrll <skrll%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ef54096f408b
branches:  trunk
changeset: 826712:ef54096f408b
user:      skrll <skrll%NetBSD.org@localhost>
date:      Sat Sep 23 14:27:44 2017 +0000

description:
PR/52553 Panic on "ifconfig athn0 up"

Don't race for a transfer in athn_usb_init on the free list for beacons.
Instead pre-assign a transfer to beacons in athn_usb_alloc_tx_list

diffstat:

 sys/dev/usb/if_athn_usb.c |  22 +++++++++++++---------
 1 files changed, 13 insertions(+), 9 deletions(-)

diffs (59 lines):

diff -r 38c28fbbdd17 -r ef54096f408b sys/dev/usb/if_athn_usb.c
--- a/sys/dev/usb/if_athn_usb.c Sat Sep 23 11:01:32 2017 +0000
+++ b/sys/dev/usb/if_athn_usb.c Sat Sep 23 14:27:44 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_athn_usb.c,v 1.22 2017/06/01 02:45:11 chs Exp $     */
+/*     $NetBSD: if_athn_usb.c,v 1.23 2017/09/23 14:27:44 skrll Exp $   */
 /*     $OpenBSD: if_athn_usb.c,v 1.12 2013/01/14 09:50:31 jsing Exp $  */
 
 /*-
@@ -22,7 +22,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_athn_usb.c,v 1.22 2017/06/01 02:45:11 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_athn_usb.c,v 1.23 2017/09/23 14:27:44 skrll Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -728,9 +728,15 @@
                /* Append this Tx buffer to our free list. */
                TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
        }
-       if (error != 0)
+       if (error == 0) {
+               /* Steal one buffer for beacons. */
+               usc->usc_tx_bcn = TAILQ_FIRST(&usc->usc_tx_free_list);
+               TAILQ_REMOVE(&usc->usc_tx_free_list, usc->usc_tx_bcn, next);
+       } else {
                athn_usb_free_tx_list(usc);
+       }
        mutex_exit(&usc->usc_tx_mtx);
+
        return error;
 }
 
@@ -749,6 +755,10 @@
                if (xfer != NULL)
                        usbd_destroy_xfer(xfer);
        }
+       if (usc->usc_tx_bcn) {
+               usbd_destroy_xfer(usc->usc_tx_bcn->xfer);
+               usc->usc_tx_bcn = NULL;
+       }
 }
 
 Static int
@@ -2756,12 +2766,6 @@
        usc->usc_cmdq.cur = usc->usc_cmdq.next = usc->usc_cmdq.queued = 0;
        mutex_spin_exit(&usc->usc_task_mtx);
 
-       /* Steal one buffer for beacons. */
-       mutex_enter(&usc->usc_tx_mtx);
-       usc->usc_tx_bcn = TAILQ_FIRST(&usc->usc_tx_free_list);
-       TAILQ_REMOVE(&usc->usc_tx_free_list, usc->usc_tx_bcn, next);
-       mutex_exit(&usc->usc_tx_mtx);
-
        curchan = ic->ic_curchan;
        extchan = NULL;