usbd_do_request_flags_pipe diagnostic panic

[takahiro hayashi <t.hash425%gmail.com@localhost>]

Hello,

On nick-nhusb branch kernel panics in usbd_transfer() when the
zero-length request gets stalled.

This happens when the uhidev driver issues usbd_set_idle to my
USB keyboard, one of its uhidevs returns stall for SET_IDLE request.

While usbd_do_request_flags_pipe() processes the xfer for SET_IDLE,
it tries to read endpoint's status and clear stall condition
if the endpoint is stalled.
It reuses the xfer to store GET_STATUS request, but ux_buf of xfer
is not allocated, then KASSERT at line 298 in usbd_transfer() fails.

Should usbd_do_request*() allocate ux_buf even if ux_length is 0?
Should I file PR this prob?


regards,
--
t-hash