kern/43143: kernel crash when closing ssh session while a tip session is open

[Christoph_Egger%gmx.de@localhost]

>Number:         43143
>Category:       kern
>Synopsis:       kernel crash when closing ssh session while a tip session is 
>open
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Apr 09 20:50:00 +0000 2010
>Originator:     Christoph Egger
>Release:        amd64 -current
>Organization:
>Environment:
>Description:

When I plug my Samsung Galaxy mobile phone via USB,
I get this dmesg output:

umodem0 at uhub1 port 2 configuration 2 interface 0
umodem0: Qualcomm Incorporated Samsung Android USB Device, rev
2.00/1.00, addr 3, iclass 2/2
umodem0: data interface 1, has no CM over data, has break
umodem0: status change notification available
ucom0 at umodem0
umodem0: WARNING: power management not supported
umass0 at uhub1 port 2 configuration 2 interface 3
umass0: Qualcomm Incorporated Samsung Android USB Device, rev 2.00/1.00,
addr 3
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 2 luns per target
sd0 at scsibus0 target 0 lun 0: <Samsung, SAMSUNG Android, Mass> disk
removable
sd0(umass0:0:0:0): preposterous sector size: 0x0.  Defaulting to 512 bytes.
sd0: fabricating a geometry
sd0: 512, 0 cyl, 64 head, 32 sec, 512 bytes/sect x 1 sectors
sd0(umass0:0:0:0): preposterous sector size: 0x0.  Defaulting to 512 bytes.
sd0: fabricating a geometry

I can connect to ucom0 with tip and exit.

When I connect to ucom0 with tip in a ssh session and exit
the ssh session with ~. then the kernel crashes:

panic: kernel diagnostic assertion "ub != NULL" failed: file
"sys/dev/usb/ucom.c", line 1005
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8023b0e5 cs 8 rflags 246 cr2 7f7ffdb10920
cpl 8 rsp ffff80004ecbb7b0
Stopped in pid 709.1 (tip) at netbsd:breakpoint+0x5: leave

db{1}> bt
breakpoint+0x5
panic+0x2ba
kern_assert+0x2d
ucomstart+0x1a9
ttywait+0x5f
ttywflush+0xf
ttylclose+0x45
ucomclose+0x7e
cdev_close+0x49
spec_close+0x118
VOP_CLOSE+0x62
vn_close+0x4b
closef+0x6a
fd_free+0x1b4
exit1+0x121
sys_exit+0x4c
syscall+0xaa
db{1}>


>How-To-Repeat:

Connect to ucom0 with tip in a ssh session and exit the ssh session
with ~.

>Fix: