Re: kern/49831: kernel panic on close of ucom tty

[Iain Hibbert <plunky%ogmig.net@localhost>]

The following reply was made to PR kern/49831; it has been noted by GNATS.

From: Iain Hibbert <plunky%ogmig.net@localhost>
To: Nick Hudson <skrll%netbsd.org@localhost>, gnats-bugs%NetBSD.org@localhost, 
    gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/49831: kernel panic on close of ucom tty
Date: Thu, 30 Jun 2016 19:19:38 +0100 (BST)

 On Wed, 29 Jun 2016, Nick Hudson wrote:
 
 > http://www.netbsd.org/~skrll/nhusb.amd64.3.netbsd
 > 
 > is ready for you to try
 
 Hi
 
 (I found it, was not in public directory :-)
 
 with this one, some progress
 
 NetBSD 7.99.29 (GENERIC) #26: Wed Jun 29 07:53:42 BST 2016
 	nick@zoom:/wrk/nhusb/obj.amd64/wrk/nhusb/src/sys/arch/amd64/compile/GENERIC
 [...]
 ehci0: handing over full speed device on port 3 to uhci1
 umct0 at uhub1 port 1
 umct0: Targus Group Intl Targus Group Intl, rev 1.10/1.03, addr 2
 ucom0 at umct0
 
 at this point the device attaches and detaches ok. With nothing connected 
 to the remote end I can open the device 'cu -l /dev/ttyU0' and disconnect 
 just fine; I did this several times with no error
 
 Then I connected a device to the RS232 port, and connected again.. it 
 opened fine, but as soon as I tried to send data I got a panic assertion
 
 panic: kernel debugging assertion "cp == ub->ub_data" failed: file "/wrk/nhusb/src/sys/dev/usb/ucom.c", line 1485 
 fatal breakpoint trap in supervisor mode
 trap type 1 code 0 rip ffffffff80114c15 cs 8 rflags 246 cr2 7e86e2d5ee10 ilevel 5 rsp fffffe8040013d90
 curlwp 0xfffffe813bb2b440 pid 0.6 lowest kstack 0xfffffe80400102c0
 Stopped in pid 0.6 (system) at	netbsd:breakpoint+0x5:	leave	
 db{0}>
 breakpoint() at netbsd:breakpoint+0x5
 vpanic() at netbsd:vpanic+0x140
 cd_play_msf() at netbsd:cd_play_msf
 ucomreadcb() at netbsd:ucomreadcb+0x3fc
 usb_transfer_complete() at netbsd:usb_transfer_complete+0x39f
 uhci_softintr() at netbsd:uhci_softintr+0x14d
 usb_soft_intr() at netbsd:usb_soft_intr+0x1f
 softint_dispatch() at netbsd:softint_dispatch+0xd3
 DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040013ff0
 Xsoftintr() at netbsd:Xsoftintr+0x4f
 --- interrupt ---
 0:
 db{0}>
 
 thanks
 iain