kern/49831: kernel panic on close of ucom tty

[plunky%ogmig.net@localhost]

>Number:         49831
>Category:       kern
>Synopsis:       closing a ucom(4) tty causes a kernel diagnostic panic
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Apr 09 18:35:00 +0000 2015
>Originator:     Iain Hibbert
>Release:        NetBSD 7.99.7, 2015-03-22 snapshot
>Organization:
	none
>Environment:
	
	
System: NetBSD galant.ogmig.net 7.99.7 NetBSD 7.99.7 (GALANT.i386) #0: Mon Mar 23 08:17:43 GMT 2015 plunky%galant.ogmig.net@localhost:/var/work/NetBSD-current/obj/sys/arch/i386/compile/GALANT i386

(the kernel is basically GENERIC, with BLUETOOTH_DEBUG and a couple of other options added)

Architecture: i386
Machine: i386

The machine is a ThinkPad T60, with Core Duo T2500 CPU
>Description:
  When closing a /dev/ttyU0 device, the system panics with a diagnostic assertion
>How-To-Repeat:
  I have here, a Targus PA088E USB->RS232 adapter. I plug it in, and see

ehci0: handing over full speed device on port 1 to uhci0
umct0 at uhub0 port 1
umct0: Targus Group Intl Targus Group Intl, rev 1.10/1.03, addr 3
ucom0 at umct0

  Then, I connect to the tty device from a shell

% cu -l /dev/ttyU0
Connected

  If something is connected, it seems you can use it as normal. It does not seem to
  matter for the purpose of this PR if anything is connected. Then, attempt to disconnect
  using the escape code ~. and see the following backtrace (typed in from a photo)

Kernel diagnostic assertion "xfer->pipe->intrxfer == xfer" failed: file "/var/cvs/NetBSD-current/src/sys/dev/usb/uhci.c", line 2453
fatal breakpoint trap in supervisor mode
..
Stopped in pid 16004.1 (cu) at
db{1}> bt
breakpoint()
vpanic()
kern_assert()
uhci_device_intr_abort()
usbd_abort_pipe()
ucom_cleanup()
ucomclose()
cdev_close()
spec_close()
VOP_CLOSE()
vn_close()
vn_closefile()
closef()
fd_free()
exit1()
sys_exit()
syscall()
--- syscall (number 1) ---
bbb7afd7
db{1}>

I note that this KASSERT() was added by skrll@ in r1.264

>Fix:
One workaround, is that just pulling the USB cable works fine and dumps you out of cu.
I guess because the ordering is different.

>Unformatted: