kern/52811: usb KASSERT when interrupting libusb midway

[martin%NetBSD.org@localhost]

>Number:         52811
>Category:       kern
>Synopsis:       usb KASSERT when interrupting libusb midway
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Dec 12 16:20:00 +0000 2017
>Originator:     Martin Husemann
>Release:        NetBSD 8.99.9
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD night-owl.duskware.de 8.99.9 NetBSD 8.99.9 (NIGHT-OWL) #564: Sun Dec 10 12:44:54 CET 2017 martin%night-owl.duskware.de@localhost:/usr/src/sys/arch/amd64/compile/NIGHT-OWL amd64
Architecture: x86_64
Machine: amd64
>Description:

I was trying to use openocd from pkgsrc, talking to my Guruplug jtag
via the ftdi driver. This does not seem to work, Openocd initialization
stalls partway through, so I interrupted it.

This immediately caused a kernel KASSERT. I have netbsd.gdb and a kernel
crash dump available.

#9  0xffffffff807c40c8 in vpanic (
    fmt=0xffffffff80ed83b0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d actlen %d length %d", ap=ap@entry=0xffffe400bf7a7e48)
    at ../../../../kern/subr_prf.c:340
#10 0xffffffff80a5832f in kern_assert (
    fmt=fmt@entry=0xffffffff80ed83b0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d actlen %d length %d")
    at ../../../../../../lib/libkern/kern_assert.c:51
#11 0xffffffff803c8b0d in usb_transfer_complete (xfer=0xffffe401073e0960)
    at ../../../../dev/usb/usbdi.c:953
#12 0xffffffff80564849 in ehci_softintr (v=<optimized out>)
    at ../../../../dev/usb/ehci.c:854
#13 0xffffffff803c6c59 in usb_soft_intr (arg=0xffffe401072c3048)
    at ../../../../dev/usb/usb.c:1070
#14 0xffffffff807a1944 in softint_execute (l=<optimized out>, 
    s=<optimized out>, si=<optimized out>)
    at ../../../../kern/kern_softint.c:589
#15 softint_dispatch (pinned=<optimized out>, s=5)
    at ../../../../kern/kern_softint.c:871
#16 0xffffffff8021c69f in Xsoftintr ()
(gdb) up 11
#11 0xffffffff803c8b0d in usb_transfer_complete (xfer=0xffffe401073e0960)
    at ../../../../dev/usb/usbdi.c:953
953                     KDASSERTMSG(xfer->ux_actlen <= xfer->ux_length,
(gdb) list
948             USBHIST_LOG(usbdebug, "xfer %#jx doing done %#jx", (uintptr_t)xfer,
949                 (uintptr_t)pipe->up_methods->upm_done, 0, 0);
950             pipe->up_methods->upm_done(xfer);
951     
952             if (xfer->ux_length != 0 && xfer->ux_buffer != xfer->ux_buf) {
953                     KDASSERTMSG(xfer->ux_actlen <= xfer->ux_length,
954                         "actlen %d length %d",xfer->ux_actlen, xfer->ux_length);
955     
956                     /* Only if IN transfer */
957                     if (usbd_xfer_isread(xfer)) {
(gdb) p *xfer
$2 = {ux_pipe = 0xffffe401251a0b88, ux_priv = 0x0, 
  ux_buffer = 0xffff80000706a144, ux_cv = {cv_opaque = {0x0, 
      0xffffe401073e0978, 0xffffffff80ed8322}}, ux_length = 16, 
  ux_actlen = 4294966299, ux_flags = 18, ux_timeout = 0, 
  ux_status = USBD_NORMAL_COMPLETION, ux_callback = 0x0, ux_done = 1 '\001', 
  ux_state = 0 '\000', ux_request = {bmRequestType = 0 '\000', 
    bRequest = 0 '\000', wValue = "\000", wIndex = "\000", wLength = "\000"}, 
  ux_frlengths = 0x0, ux_nframes = 0, 
  ux_methods = 0xffffffff80dd4540 <ehci_device_bulk_methods>, 
  ux_bus = 0xffffe401072c3048, ux_dmabuf = {udma_block = 0xffffe401073cea48, 
    udma_offs = 0}, ux_buf = 0xffff800065e0e000, ux_bufsize = 1024, 
  ux_rqflags = 0 '\000', ux_next = {sqe_next = 0x0}, ux_hcpriv = 0x0, 
  ux_hcflags = 0 '\000', ux_hccv = {cv_opaque = {0x0, 0xffffe401073e0a18, 
      0xffffffff80ed832a}}, ux_callout = {_c_store = {0x0, 0x0, 0x0, 0x0, 
      0xffffffff8133aba0 <callout_cpu0>, 0x10000000000, 0x11deeba1, 0x0, 0x0, 
      0x0}}}



>How-To-Repeat:
s/a

>Fix:
n/a