kern/51528: usb_mem.c panic triggered by mounting USB pen drive

[dhgutteridge%sympatico.ca@localhost]

>Number:         51528
>Category:       kern
>Synopsis:       usb_mem.c panic triggered by mounting USB pen drive
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Oct 04 06:00:00 +0000 2016
>Originator:     David H. Gutteridge
>Release:        HEAD
>Organization:
>Environment:
NetBSD arcusv.nonus-porta.net 7.99.39 NetBSD 7.99.39 (ARCUSV_DEBUG) #0: Mon Oct  3 19:51:49 EDT 2016  disciple%arcus-v3.nonus-porta.net@localhost:/home/disciple/netbsd-current/src/sys/arch/macppc/compile/obj/ARCUSV_DEBUG macppc
>Description:
When trying to mount a USB pen drive on a machine with 7.99.39/macppc
a panic is immediately triggered. With DIAGNOSTIC enabled, the result
is:

panic: kernel diagnostic assertion "offset < dma->udma_block->size" failed: file "/home/disciple/netbsd-current/src/sys/dev/usb/usb_mem.c", line 392 offset 65536 vs 65536
Stopped in pid 0.6 (system) at  netbsd:vpanic+0x140:    addi    r4, r0, 0x0
0x10013c70: at kern_assert+0x68
0x10013cb0: at usb_dmaaddr+0x154
0x10013cd0: at ohci_reset_std_chain+0x260
0x10013d40: at ohci_device_bulk_start+0x26c
0x10013da0: at usbd_transfer+0x194
0x10013de0: at umass_setup_transfer.part.1+0x40
0x10013df0: at umass_bbb_state+0x4f8
0x10013e20: at usb_transfer_complete+0x7b4
0x10013e60: at ohci_softintr+0xd04
0x10013ec0: at usb_soft_intr+0x2c
0x10013ed0: at softint_dispatch+0x138
0x10013f20: at softint_fast_dispatch+0xdc
0x10013fe8: at 0xfffffffc

(A kernel without DIAGNOSTIC enabled also panics.)

The source is as of October 3 16:56 EST.

>How-To-Repeat:
Mount a USB pen drive on the machine in question.
>Fix: