From d78befcef4ef33d8fcd709cb899b4f54e5f7a90d Mon Sep 17 00:00:00 2001
From: skrll <skrll@NetBSD.org>
Date: Fri, 5 Jun 2020 08:02:32 +0000
Subject: [PATCH] Replace calls to usbd_device2interface_handle in u3g_match()
 and u3g_attach() with the interface already passed in uiaa->uiaa_iface and
 store the interface in sc->sc_iface for later use by u3g_open()/

Also skip Direct IP interfaces in u3g_match() to avoid potential side effects.

PR kern/55330
---
 sys/dev/usb/u3g.c | 45 ++++++++++++++++++---------------------------
 1 file changed, 18 insertions(+), 27 deletions(-)

diff --git a/sys/dev/usb/u3g.c b/sys/dev/usb/u3g.c
index 5cde93e5a1c7..be51ae01870c 100644
--- a/sys/dev/usb/u3g.c
+++ b/sys/dev/usb/u3g.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: u3g.c,v 1.40 2020/02/15 02:14:02 manu Exp $	*/
+/*	$NetBSD: u3g.c,v 1.41 2020/06/05 08:02:32 skrll Exp $	*/
 
 /*-
  * Copyright (c) 2009 The NetBSD Foundation, Inc.
@@ -50,7 +50,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: u3g.c,v 1.40 2020/02/15 02:14:02 manu Exp $");
+__KERNEL_RCSID(0, "$NetBSD: u3g.c,v 1.41 2020/06/05 08:02:32 skrll Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -114,6 +114,7 @@ struct u3g_softc {
 	struct usbd_device *	sc_udev;
 	bool			sc_dying;	/* We're going away */
 	int			sc_ifaceno;	/* Device interface number */
+	struct usbd_interface	*sc_iface;	/* Device interface */
 
 	struct u3g_com {
 		device_t	c_dev;		/* Child ucom(4) handle */
@@ -271,21 +272,12 @@ static int
 u3g_match(device_t parent, cfdata_t match, void *aux)
 {
 	struct usbif_attach_arg *uiaa = aux;
-	struct usbd_interface *iface;
+	struct usbd_interface *iface = uiaa->uiaa_iface;
 	usb_interface_descriptor_t *id;
-	usbd_status error;
 
 	if (!usb_lookup(u3g_devs, uiaa->uiaa_vendor, uiaa->uiaa_product))
 		return UMATCH_NONE;
 
-	error = usbd_device2interface_handle(uiaa->uiaa_device,
-	    uiaa->uiaa_ifaceno, &iface);
-	if (error) {
-		printf("u3g_match: failed to get interface, err=%s\n",
-		    usbd_errstr(error));
-		return UMATCH_NONE;
-	}
-
 	id = usbd_get_interface_descriptor(iface);
 	if (id == NULL) {
 		printf("u3g_match: failed to get interface descriptor\n");
@@ -301,6 +293,16 @@ u3g_match(device_t parent, cfdata_t match, void *aux)
 	    (id->bInterfaceProtocol & 0xf) == 6)	/* 0x16, 0x46, 0x76 */
 		return UMATCH_NONE;
 
+	/*
+	 * Sierra Wireless modems use the vendor-specific class also for
+	 * Direct IP or QMI interfaces, which we should avoid attaching to.
+	 */
+	if (uiaa->uiaa_vendor == USB_VENDOR_SIERRA &&
+	    id->bInterfaceClass == UICLASS_VENDOR &&
+	    uiaa->uiaa_product == USB_PRODUCT_SIERRA_USB305 &&
+	     uiaa->uiaa_ifaceno >= 7)
+		return UMATCH_NONE;
+
 	/*
 	 * 3G modems generally report vendor-specific class
 	 *
@@ -316,7 +318,7 @@ u3g_attach(device_t parent, device_t self, void *aux)
 	struct u3g_softc *sc = device_private(self);
 	struct usbif_attach_arg *uiaa = aux;
 	struct usbd_device *dev = uiaa->uiaa_device;
-	struct usbd_interface *iface;
+	struct usbd_interface *iface = uiaa->uiaa_iface;
 	usb_interface_descriptor_t *id;
 	usb_endpoint_descriptor_t *ed;
 	struct ucom_attach_args ucaa;
@@ -330,13 +332,6 @@ u3g_attach(device_t parent, device_t self, void *aux)
 	sc->sc_dying = false;
 	sc->sc_udev = dev;
 
-	error = usbd_device2interface_handle(dev, uiaa->uiaa_ifaceno, &iface);
-	if (error) {
-		aprint_error_dev(self, "failed to get interface, err=%s\n",
-		    usbd_errstr(error));
-		return;
-	}
-
 	id = usbd_get_interface_descriptor(iface);
 
 	ucaa.ucaa_info = "3G Modem";
@@ -352,6 +347,7 @@ u3g_attach(device_t parent, device_t self, void *aux)
 	ucaa.ucaa_bulkin = ucaa.ucaa_bulkout = -1;
 
 	sc->sc_ifaceno = uiaa->uiaa_ifaceno;
+	sc->sc_iface = uiaa->uiaa_iface;
 	intr_address = -1;
 	intr_size = 0;
 
@@ -577,7 +573,6 @@ u3g_open(void *arg, int portno)
 	struct u3g_softc *sc = arg;
 	usb_endpoint_descriptor_t *ed;
 	usb_interface_descriptor_t *id;
-	struct usbd_interface *ih;
 	usbd_status err;
 	struct u3g_com *com = &sc->sc_com[portno];
 	int i, nin;
@@ -585,14 +580,10 @@ u3g_open(void *arg, int portno)
 	if (sc->sc_dying)
  		return EIO;
 
-	err = usbd_device2interface_handle(sc->sc_udev, sc->sc_ifaceno, &ih);
-	if (err)
-		return EIO;
-
-	id = usbd_get_interface_descriptor(ih);
+	id = usbd_get_interface_descriptor(sc->sc_iface);
 
 	for (nin = i = 0; i < id->bNumEndpoints; i++) {
-		ed = usbd_interface2endpoint_descriptor(ih, i);
+		ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
 		if (ed == NULL)
 			return EIO;