kern/39651: Panic in uhci_device_ctrl_start() while unplugging USB device

[lacombar%gmail.com@localhost]

>Number:         39651
>Category:       kern
>Synopsis:       Panic in uhci_device_ctrl_start() while unplugging USB device
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Sep 29 15:15:00 +0000 2008
>Originator:     Arnaud Lacombe
>Release:        4.99.72
>Organization:
n/a
>Environment:
NetBSD oui 4.99.72 NetBSD 4.99.72 (OUI) #0: Sun Sep 28 17:00:00 EDT 2008  
of@oui:/build/current/obj/20080928/sys/arch/i386/compile/OUI i386
>Description:
The system panic in uhci_device_ctrl_start() after several plug/unplug of a USB 
device. After reboot, gdb gives the following backtrace:

#6  0xc03c41ac in trap (frame=0xcb109b44) at /src/sys/arch/i386/i386/trap.c:352
#7  0xc010cb1f in calltrap ()
#8  0xc0204482 in uhci_device_ctrl_start (xfer=0xc0f8b100) at 
/src/sys/dev/usb/uhci.c:2467
#9  0xc043060f in usb_transfer_complete (xfer=0xc0f8b200) at 
/src/sys/dev/usb/usbdi.c:887
#10 0xc0201c2e in uhci_abort_xfer (xfer=0xc0f8b200, status=<value optimized 
out>) at /src/sys/dev/usb/uhci.c:2201
#11 0xc04310e9 in usbd_abort_pipe (pipe=0xc1028600) at 
/src/sys/dev/usb/usbdi.c:721
#12 0xc04326d1 in usbd_kill_pipe (pipe=0x1) at /src/sys/dev/usb/usb_subr.c:751
#13 0xc0432718 in usb_free_device (dev=0xc1028b80) at 
/src/sys/dev/usb/usb_subr.c:1444
#14 0xc04351c4 in uhub_explore (dev=0xc0f85a00) at /src/sys/dev/usb/uhub.c:469
#15 0xc042e81a in usb_discover (sc=0xca6ccdd4) at /src/sys/dev/usb/usb.c:800
#16 0xc042ebd7 in usb_event_thread (arg=0xca6ccdd4) at 
/src/sys/dev/usb/usb.c:381
#17 0xc01002e1 in lwp_trampoline ()

the faulty code is:

uhci_device_ctrl_start() {
    [...]
    upipe->u.ctl.length = len;
    memcpy(KERNADDR(&upipe->u.ctl.reqdma, 0), req, sizeof *req);
    [...]
}

A crash dump is available for further analysis.
>How-To-Repeat:
Plug/unplug a USB device. Seems to happen more often with umass devices.
>Fix:
n/a