3.1 USB panic

[der Mouse <mouse%Rodents-Montreal.ORG@localhost>]

I have a USB SD card reader.  I had it connected to an i386 machine
running 3.1.  This works fine with a "64MB" SanDisk card.  But I tried
it with a "4GB" Kingston "miniSD" card in the SD-form-factor adapter
which came with it, and it didn't work.  First access attempt stalled,
eventually printing a timeout message.  I was unable to wake it up, so
I pulled the USB cable.

The kernel promptly panicked.

This turns out to be repeatable - I just had it happen again, trying
the Kingston card again - and I can give a detailed report on this
second time.  The timeout message is

umass0: BBB bulk-out stall clear failed, TIMEOUT

and here's what ensued when I pulled the USB cable.  This happened so
fast I couldn't even tell for sure there were lines lost off the top of
the screen.  I also notice one "typo" (the word is inappropriate
because I'm not actually typing this), "syscall_plaio" on the last line
before the "--- syscall" line.  This was obtained fromk dmesg after the
system came back up; since I didn't power it down in the meantime, I
don't know what produced that corruption.

| umass0: at uhub2 port 1 (addr 2) disconnected
| sd0 detached
| sd1 detached
| sd2(umass0:0:0:2): generic HBA error
| sd2(umass0:0:0:2): generic HBA error
| sd2(umass0:0:0:2): generic HBA error
| sd2 detached
| sd3 detached
| uvm_fault(0xcdb071c4, 0, 0, 1) -> 0xe
| fatal page fault in supervisor mode
| trap type 6 code 0 eip c03ced6a cs 8 eflags 10296 cr2 c ilevel 0
| panic: trap
| Begin traceback...
| trap() at netbsd:trap+0x149
| --- trap (number 6) ---
| spec_open(cd23fda4,0,cd23fdec,0,c060db20) at netbsd:spec_open+0x152
| VOP_OPEN(cff7ee88,1,cb5a024c,ce3f8b2c,cb5a024c) at netbsd:VOP_OPEN+0x34
| vn_open(cd23feb4,1,64,fffffffc,1) at netbsd:vn_open+0x352
| sys_open(cdb03c64,cd23ff64,cd23ff5c,0,8001003b) at netbsd:sys_open+0xbc
| syscall_plaio() at netbsd:syscall_plain+0x7e
| --- syscall (number 5) ---
| 0xbdb3a047:
| End traceback...
| syncing disks... done
| 
| dumping to dev 0,1 offset 6774856
| dump 959 958 [...]

I have the kernel coredump, if anyone thinks it's worth looking at.

The USB device and its autoconf chain:

mainbus0 (root)
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
ohci0 at pci0 dev 3 function 0: Silicon Integrated System 5597/5598 USB host 
controller (rev. 0x0f)
ohci0: interrupting at irq 10
ohci0: OHCI version 1.0, legacy support
usb0 at ohci0: USB revision 1.0
uhub0 at usb0
uhub0: Silicon Integra OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 3 ports with 3 removable, self powered
ohci1 at pci0 dev 3 function 1: Silicon Integrated System 5597/5598 USB host 
controller (rev. 0x0f)
ohci1: interrupting at irq 3
ohci1: OHCI version 1.0, legacy support
usb1 at ohci1: USB revision 1.0
uhub1 at usb1
uhub1: Silicon Integra OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 3 ports with 3 removable, self powered
ehci0 at pci0 dev 3 function 2: Silicon Integrated System 7002 USB 2.0 host 
controller (rev. 0x00)
ehci0: interrupting at irq 5
ehci0: BIOS has given up ownership
ehci0: EHCI version 1.0
ehci0: companion controllers, 3 ports each: ohci0 ohci1
usb2 at ehci0: USB revision 2.0
uhub2 at usb2
uhub2: Silicon Integra EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub2: single transaction translator
uhub2: 6 ports with 6 removable, self powered
umass0 at uhub2 port 1 configuration 1 interface 0
umass0: Genesys Logic Flash Reader, rev 2.00/1.19, addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 4 luns per target
sd0 at scsibus0 target 0 lun 0: <Generic, STORAGE DEVICE, 0119> disk removable
sd0: drive offline
sd1 at scsibus0 target 0 lun 1: <Generic, STORAGE DEVICE, 0119> disk removable
sd1: drive offline
sd2 at scsibus0 target 0 lun 2: <Generic, STORAGE DEVICE, 0119> disk removable
sd2: drive offline
sd3 at scsibus0 target 0 lun 3: <Generic, STORAGE DEVICE, 0119> disk removable
sd3: drive offline

Is this worth a PR?  Even if the USB SDcard interface device is broken,
ISTM the kernel shouldn't panic.  But I-also-STM that 3.1 is considered
old enough that people don't care about it.

/~\ The ASCII                             Mouse
\ / Ribbon Campaign
 X  Against HTML                mouse%rodents-montreal.org@localhost
/ \ Email!           7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B