>Number:         15796
>Category:       kern
>Synopsis:       usb code panics at least in uhci_abort_xfer()
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Mar 03 08:02:00 PST 2002
>Closed-Date:
>Last-Modified:
>Originator:     Frank Kardel
>Release:        NetBSD 1.5ZA
>Organization:
>Environment:
System: NetBSD pip 1.5ZA NetBSD 1.5ZA (PIP) #0: Thu Mar 2 xx:xx:xx MET 2002 kardel@pip:/fs/IC35L060-0-a/src/NetBSD/netbsd/sys/arch/i386/compile/PIP i386
Architecture: i386
Machine: i386
>Description:
	usb code panics due to page fault in supervisor mode when
	defreferencing upipe->pipe.device for member "bus". There
	may be more panics lurking. Code around 20020221 was ok
	wrt panics.

void
uhci_abort_xfer(usbd_xfer_handle xfer, usbd_status status)
{
        uhci_intr_info_t *ii = &UXFER(xfer)->iinfo;
        struct uhci_pipe *upipe = (struct uhci_pipe *)xfer->pipe;
        uhci_softc_t *sc = (uhci_softc_t *)upipe->pipe.device->bus;
                                                             ^ CRASH here

>How-To-Repeat:
	Build current kernel after Mar 1, 2002 have some usb devices
	attached and sit back --- panic usually occurs when going multiuser
	or X accesses the mouse or data is transferred to the printer.

	My usb-tree:
p: 16:58 ~kardel/inetwml [3]# usbdevs -v
Controller /dev/usb0:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), VIA Technologie(0x1106), rev 1.00
 port 1 addr 2: full speed, self powered, config 1, DeskJet 1220C(0x0212), Hewlett-Packard(0x03f0), rev 1.00
 port 2 addr 3: full speed, self powered, config 1, UT-USB41 hub(0x1446), Texas Instruments(0x0451), rev 1.10
  port 1 addr 4: full speed, power 400 mA, config 2, ELSA Modem Board(0x2267), Lucent Technologies, Inc.(0x05cc), rev 1.00
  port 2 addr 5: low speed, power 100 mA, config 1, Microsoft IntelliMouse ® with IntelliEye(0x0025), Microsoft(0x045e), rev 1.01
  port 3 powered
  port 4 powered
Controller /dev/usb1:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), VIA Technologie(0x1106), rev 1.00
 port 1 powered
 port 2 addr 2: full speed, self powered, config 1, Perfection1640(0x010a), EPSON(0x04b8), rev 1.04

>Fix:
	Use kernel before usb changes around 25th-28th of February 8-( && 8-).

>Release-Note:
>Audit-Trail:
>Unformatted:
 	kernel after 20020228