kern/51458: usb athn panic

[pr%xn--rvztrtkrfrgp-bbb7j2b8f0b9d7a21oft.com@localhost]

>Number:         51458
>Category:       kern
>Synopsis:       usb athn panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 03 03:45:00 +0000 2016
>Originator:     Ben Gergely
>Release:        7.99.36
>Organization:
>Environment:
NetBSD 7.99.36 amd64
>Description:
Panic on attach of a athn* device:

athn0 at uhub4 port 2
uvm_fault(0xffffffff81713ac0, 0x0, 2) -> e
fatal page fault in supervisor mode
trap type 6 code 2 rip ffffffff803a1081 cs 8 rflags 10286 cr2 0 ilevel 5 rsp fffffe8045b90ac0
curlwp 0xfffffe8045c4a580 pid 0.59 lowest kstack 0xfffffe8045b8d2c0
panic: trap
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x140
snprintf() at netbsd:snprintf
trap() at netbsd:trap+0xc4b
--- trap (number 6) ---
athn_usb_htc_msg.part.9() at netbsd:athn_usb_htc_msg.part.9+0x1c
athn_usb_htc_connect_svc() at netbsd:athn_usb_htc_connect_svc+0xbc
athn_usb_attachhook() at netbsd:athn_usb_attachhook+0x298
athn_usb_attach() at netbsd:athn_usb_attach+0x395
config_attach_loc() at netbsd:config_attach_loc+0x17a
config_found_sm_loc() at netbsd:config_found_sm_loc+0x48
usbd_attachwholedevice() at netbsd:usbd_attachwholedevice+0x8e
usbd_probe_and_attach() at netbsd:usbd_probe_and_attach+0x46
usbd_new_device() at netbsd:usbd_new_device+0xf0d
uhub_explore() at netbsd:uhub_explore+0x2f4
usb_discover() at netbsd:usb_discover+0x6f
usb_event_thread() at netbsd:usb_event_thread+0x238
cpu0: End traceback...

#0  0xffffffff80119a95 in cpu_reboot ()
#1  0xffffffff8083b9ec in vpanic ()
#2  0xffffffff8083baa0 in panic ()
#3  0xffffffff8011b716 in trap ()
#4  0xffffffff8010115e in alltraps ()
#5  0xffffffff803a1081 in athn_usb_htc_msg.part ()
#6  0xffffffff803a11a6 in athn_usb_htc_connect_svc ()
#7  0xffffffff803a14c7 in athn_usb_attachhook ()
#8  0xffffffff803a26e4 in athn_usb_attach ()
#9  0xffffffff8082500e in config_attach_loc ()
#10 0xffffffff8082511d in config_found_sm_loc ()
#11 0xffffffff8032f6da in usbd_attachwholedevice ()
#12 0xffffffff80332882 in usbd_probe_and_attach ()
#13 0xffffffff80334e33 in usbd_new_device ()
#14 0xffffffff80336ec5 in uhub_explore ()
#15 0xffffffff8032469c in usb_discover ()
#16 0xffffffff803249fc in usb_event_thread ()
#17 0xffffffff801008d7 in lwp_trampoline ()
#18 0x0000000000000000 in ?? ()


#0  0xffffffff80119a95 in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
    at /usr/src/sys/arch/amd64/amd64/machdep.c:676
#1  0xffffffff8083b9ec in vpanic (fmt=fmt@entry=0xffffffff80ec8b4b "trap", 
    ap=ap@entry=0xfffffe8045b90898) at /usr/src/sys/kern/subr_prf.c:342
#2  0xffffffff8083baa0 in panic (fmt=fmt@entry=0xffffffff80ec8b4b "trap")
    at /usr/src/sys/kern/subr_prf.c:258
#3  0xffffffff8011b716 in trap (frame=0xfffffe8045b909d0)
    at /usr/src/sys/arch/amd64/amd64/trap.c:298
#4  0xffffffff8010115e in alltraps ()
#5  0xffffffff803a1081 in athn_usb_htc_msg (usc=0x0, usc@entry=0xffff8000071ed000,
    msg_id=msg_id@entry=2, buf=buf@entry=0xfffffe8045b90b00, len=len@entry=8)
    at /usr/src/sys/dev/usb/if_athn_usb.c:919
#6  0xffffffff803a11a6 in athn_usb_htc_msg (len=8, buf=0xfffffe8045b90b00, msg_id=2,
    usc=0xffff8000071ed000) at /usr/src/sys/dev/usb/if_athn_usb.c:1052
#7  athn_usb_htc_connect_svc (usc=usc@entry=0xffff8000071ed000, svc_id=svc_id@entry=256,
    ul_pipe=ul_pipe@entry=4 '\004', dl_pipe=dl_pipe@entry=131 '\203',
    endpoint_id=endpoint_id@entry=0xffff8000071f20c0 "")
    at /usr/src/sys/dev/usb/if_athn_usb.c:1028
#8  0xffffffff803a14c7 in athn_usb_htc_setup (usc=0xffff8000071ed000)
    at /usr/src/sys/dev/usb/if_athn_usb.c:944
#9  athn_usb_attachhook (arg=<optimized out>) at /usr/src/sys/dev/usb/if_athn_usb.c:379
#10 0xffffffff803a26e4 in athn_usb_attach (parent=<optimized out>, self=0xfffffe8090d81c08,
    aux=<optimized out>) at /usr/src/sys/dev/usb/if_athn_usb.c:306
#11 0xffffffff8082500e in config_attach_loc (parent=parent@entry=0xfffffe8045d00988,
    cf=<optimized out>, locs=locs@entry=0xfffffe8045b90cd0, aux=aux@entry=0xfffffe8045b90ce8,
    print=print@entry=0xffffffff8032fdc3 <usbd_print>) at /usr/src/sys/kern/subr_autoconf.c:1601
#12 0xffffffff8082511d in config_found_sm_loc (parent=parent@entry=0xfffffe8045d00988,
    ifattr=ifattr@entry=0xffffffff80f0aa79 "usbdevif", locs=locs@entry=0xfffffe8045b90cd0,
    aux=aux@entry=0xfffffe8045b90ce8, print=print@entry=0xffffffff8032fdc3 <usbd_print>,
    submatch=<optimized out>) at /usr/src/sys/kern/subr_autoconf.c:1094
#13 0xffffffff8032f6da in usbd_attachwholedevice (parent=parent@entry=0xfffffe8045d00988,
    dev=dev@entry=0xfffffe80be49ec60, port=port@entry=2, usegeneric=usegeneric@entry=0)
    at /usr/src/sys/dev/usb/usb_subr.c:904
#14 0xffffffff80332882 in usbd_probe_and_attach (parent=parent@entry=0xfffffe8045d00988,
    dev=dev@entry=0xfffffe80be49ec60, port=port@entry=2, addr=addr@entry=2)
    at /usr/src/sys/dev/usb/usb_subr.c:1022
#15 0xffffffff80334e33 in usbd_new_device (parent=0xfffffe8045d00988, bus=0xfffffe80459c6048,
    depth=<optimized out>, speed=<optimized out>, port=port@entry=2,
    up=up@entry=0xfffffe80938bd428) at /usr/src/sys/dev/usb/usb_subr.c:1368
#16 0xffffffff80336ec5 in uhub_explore (dev=0xfffffe8045c80b70)
    at /usr/src/sys/dev/usb/uhub.c:758
#17 0xffffffff8032469c in usb_discover (sc=sc@entry=0xfffffe80bfce3648)
    at /usr/src/sys/dev/usb/usb.c:921
#18 0xffffffff803249fc in usb_event_thread (arg=0xfffffe80bfce3648)
    at /usr/src/sys/dev/usb/usb.c:475
#19 0xffffffff801008d7 in lwp_trampoline ()
#20 0x0000000000000000 in ?? ()

>How-To-Repeat:

>Fix: