[Bug 281843] "check for in-use endpoints" code in usb_config_parse() is missing an increment

From: <bugzilla-noreply_at_freebsd.org>
Date: Fri, 04 Oct 2024 03:26:19 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281843

            Bug ID: 281843
           Summary: "check for in-use endpoints" code in
                    usb_config_parse() is missing an increment
           Product: Base System
           Version: 13.3-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: usb
          Assignee: usb@FreeBSD.org
          Reporter: mhjacobson@me.com

sys/dev/usb/usb_device.c:846 (in usb_config_parse()):

```
                /* check for in-use endpoints */

                if (cmd == USB_CFG_INIT) {
                        ep = udev->endpoints;
                        ep_max = udev->endpoints_max;
                        while (ep_max--) {
                                /* look for matching endpoints */
                                if (iface_index == USB_IFACE_INDEX_ANY ||
                                    iface_index == ep->iface_index) {
                                        if (ep->refcount_alloc != 0)
                                                return (USB_ERR_IN_USE);
                                }
                        }
                }
```

This code is missing an `ep++`.  See the similar loop below, which does have
the increment.

I'm hitting a panic that seems to be caused by changing alternate interface
index while transfers are outstanding, which this code is supposed to prevent. 
I suspect (but don't know for sure) that this is at least part of the problem.

-- 
You are receiving this mail because:
You are the assignee for the bug.