Re: kern/38528 (panic on unplugging Apple USB keyboard)

[Matthias Drochner <M.Drochner%fz-juelich.de@localhost>]

Christoph_Egger%gmx.de@localhost said:
> db{1}> bt
> uhidev_childdet() at netbsd:uhidev_childdet+0x32
> config_detach() at netbsd:config_detach+0x1de 

This is a different bug, a new one. Can you try the appended patch?

best regards
Matthias





-------------------------------------------------------------------
-------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich

Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzende des Aufsichtsrats: MinDir'in Baerbel Brumme-Bothe
Geschaeftsfuehrung: Prof. Dr. Achim Bachem (Vorsitzender),
Dr. Ulrich Krafft (stellv. Vorsitzender), Prof. Dr. Harald Bolt,
Dr. Sebastian M. Schmidt
-------------------------------------------------------------------
-------------------------------------------------------------------

#
# old_revision [bdb4e55c6bf540d7f3dea8012f0ea2b929c2e69b]
#
# patch "sys/dev/usb/uhidev.c"
#  from [f79d1c3609a5e0b85227db74ee82e45cab36bf8a]
#    to [6cb6f4302877f3032082964a88c8881fb7ab138e]
# 
# patch "sys/dev/usb/uhidev.h"
#  from [f34395cbd85e729f736a8288b1d9622082443c55]
#    to [8badca5b78c7b292fc1923c22ede3e6d17dd95dc]
#
============================================================
--- sys/dev/usb/uhidev.c        f79d1c3609a5e0b85227db74ee82e45cab36bf8a
+++ sys/dev/usb/uhidev.c        6cb6f4302877f3032082964a88c8881fb7ab138e
@@ -103,7 +103,8 @@ USB_ATTACH(uhidev)
        usb_interface_descriptor_t *id;
        usb_endpoint_descriptor_t *ed;
        struct uhidev_attach_arg uha;
-       struct uhidev *dev;
+       device_t dev;
+       struct uhidev *csc;
        int size, nrepid, repid, repsz;
        int *repsizes;
        int i;
@@ -290,16 +291,17 @@ nomem:
                        uha.reportid = repid;
                        locs[UHIDBUSCF_REPORTID] = repid;
 
-                       dev = device_private(config_found_sm_loc(self,
+                       dev = config_found_sm_loc(self,
                                "uhidbus", locs, &uha,
-                               uhidevprint, config_stdsubmatch));
+                               uhidevprint, config_stdsubmatch);
                        sc->sc_subdevs[repid] = dev;
                        if (dev != NULL) {
-                               dev->sc_in_rep_size = repsizes[repid];
+                               csc = device_private(dev);
+                               csc->sc_in_rep_size = repsizes[repid];
 #ifdef DIAGNOSTIC
                                DPRINTF(("uhidev_match: repid=%d dev=%p\n",
                                         repid, dev));
-                               if (dev->sc_intr == NULL) {
+                               if (csc->sc_intr == NULL) {
                                        free(repsizes, M_TEMP);
                                        aprint_error_dev(self,
                                            "sc_intr == NULL\n");
@@ -307,8 +309,8 @@ nomem:
                                }
 #endif
 #if NRND > 0
-                               rnd_attach_source(&dev->rnd_source,
-                                                 USBDEVNAME(dev->sc_dev),
+                               rnd_attach_source(&csc->rnd_source,
+                                                 USBDEVNAME(dev),
                                                  RND_TYPE_TTY, 0);
 #endif
                        }
@@ -362,7 +364,7 @@ uhidev_activate(device_t self, enum deva
                for (i = 0; i < sc->sc_nrepid; i++)
                        if (sc->sc_subdevs[i] != NULL)
                                rv |= config_deactivate(
-                                       sc->sc_subdevs[i]->sc_dev);
+                                       sc->sc_subdevs[i]);
                sc->sc_dying = 1;
                break;
        default:
@@ -379,7 +381,7 @@ uhidev_childdet(device_t self, device_t 
        struct uhidev_softc *sc = device_private(self);
 
        for (i = 0; i < sc->sc_nrepid; i++) {
-               if (sc->sc_subdevs[i]->sc_dev == child)
+               if (sc->sc_subdevs[i] == child)
                        break;
        }
        KASSERT(i < sc->sc_nrepid);
@@ -390,6 +392,9 @@ USB_DETACH(uhidev)
 {
        USB_DETACH_START(uhidev, sc);
        int i, rv;
+#if NRND > 0
+       struct uhidev *csc;
+#endif
 
        DPRINTF(("uhidev_detach: sc=%p flags=%d\n", sc, flags));
 
@@ -404,9 +409,10 @@ USB_DETACH(uhidev)
        for (i = 0; i < sc->sc_nrepid; i++) {
                if (sc->sc_subdevs[i] != NULL) {
 #if NRND > 0
-                       rnd_detach_source(&sc->sc_subdevs[i]->rnd_source);
+                       csc = device_private(sc->sc_subdevs[i]);
+                       rnd_detach_source(&csc->rnd_source);
 #endif
-                       rv |= config_detach(sc->sc_subdevs[i]->sc_dev, flags);
+                       rv |= config_detach(sc->sc_subdevs[i], flags);
                }
        }
 
@@ -422,6 +428,7 @@ uhidev_intr(usbd_xfer_handle xfer, usbd_
 uhidev_intr(usbd_xfer_handle xfer, usbd_private_handle addr, usbd_status 
status)
 {
        struct uhidev_softc *sc = addr;
+       device_t cdev;
        struct uhidev *scd;
        u_char *p;
        u_int rep;
@@ -460,10 +467,13 @@ uhidev_intr(usbd_xfer_handle xfer, usbd_
                printf("uhidev_intr: bad repid %d\n", rep);
                return;
        }
-       scd = sc->sc_subdevs[rep];
+       cdev = sc->sc_subdevs[rep];
+       if (!cdev)
+               return;
+       scd = device_private(cdev);
        DPRINTFN(5,("uhidev_intr: rep=%d, scd=%p state=0x%x\n",
                    rep, scd, scd ? scd->sc_state : 0));
-       if (scd == NULL || !(scd->sc_state & UHIDEV_OPEN))
+       if (!(scd->sc_state & UHIDEV_OPEN))
                return;
        if (scd->sc_in_rep_size != cc) {
                printf("%s: bad input length %d != %d\n",
============================================================
--- sys/dev/usb/uhidev.h        f34395cbd85e729f736a8288b1d9622082443c55
+++ sys/dev/usb/uhidev.h        8badca5b78c7b292fc1923c22ede3e6d17dd95dc
@@ -53,7 +53,7 @@ struct uhidev_softc {
        int sc_repdesc_size;
 
        u_int sc_nrepid;
-       struct uhidev **sc_subdevs;
+       device_t *sc_subdevs;
 
        int sc_refcnt;
        u_char sc_dying;