MFC r267240:

Resolve a deadlock setting the USB configuration index from userspace
on USB HUBs by moving the code into the USB explore threads. The
deadlock happens because child devices of the USB HUB don't have the
expected reference count when called from outside the explore
thread. Only the HUB device itself, which the IOCTL interface locks,
gets the correct reference count.

1 files changed, 8 insertions, 3 deletions

diff --git a/sys/dev/usb/usb_dev.c b/sys/dev/usb/usb_dev.c
index e4471ae..6ad02a7 100644
--- a/sys/dev/usb/usb_dev.c
+++ b/sys/dev/usb/usb_dev.c
@@ -1116,9 +1116,14 @@ usb_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int fflag, struct thread*
 
 		usb_pause_mtx(NULL, hz / 128);
 
-		if (usb_ref_device(cpd, &refs, 1 /* need uref */)) {
-			err = ENXIO;
-			goto done;
+		while (usb_ref_device(cpd, &refs, 1 /* need uref */)) {
+			if (usb_ref_device(cpd, &refs, 0)) {
+				/* device no longer exits */
+				err = ENXIO;
+				goto done;
+			}
+			usb_unref_device(cpd, &refs);
+			usb_pause_mtx(NULL, hz / 128);
 		}
 	}