Re: kern/38528 (panic on unplugging Apple USB keyboard)

[Matthias Drochner <M.Drochner%fz-juelich.de@localhost>]

The following reply was made to PR kern/38528; it has been noted by GNATS.

From: Matthias Drochner <M.Drochner%fz-juelich.de@localhost>
To: Christoph Egger <Christoph_Egger%gmx.de@localhost>
Cc: gnats-bugs%NetBSD.org@localhost, kern-bug-people%NetBSD.org@localhost,
        netbsd-bugs%NetBSD.org@localhost, gnats-admin%NetBSD.org@localhost, 
drochner%NetBSD.org@localhost
Subject: Re: kern/38528 (panic on unplugging Apple USB keyboard) 
Date: Mon, 26 May 2008 12:39:33 +0200

 This is a multipart MIME message.
 
 --==_Exmh_10470162210690
 Content-Type: text/plain; charset=us-ascii
 
 
 Christoph_Egger%gmx.de@localhost said:
 > db{1}> bt
 > uhidev_childdet() at netbsd:uhidev_childdet+0x32
 > config_detach() at netbsd:config_detach+0x1de 
 
 This is a different bug, a new one. Can you try the appended patch?
 
 best regards
 Matthias
 
 
 
 
 
 -------------------------------------------------------------------
 -------------------------------------------------------------------
 Forschungszentrum Juelich GmbH
 52425 Juelich
 
 Sitz der Gesellschaft: Juelich
 Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
 Vorsitzende des Aufsichtsrats: MinDir'in Baerbel Brumme-Bothe
 Geschaeftsfuehrung: Prof. Dr. Achim Bachem (Vorsitzender),
 Dr. Ulrich Krafft (stellv. Vorsitzender), Prof. Dr. Harald Bolt,
 Dr. Sebastian M. Schmidt
 -------------------------------------------------------------------
 -------------------------------------------------------------------
 
 --==_Exmh_10470162210690
 Content-Type: text/plain ; name="uhid.txt"; charset=us-ascii
 Content-Description: uhid.txt
 Content-Disposition: attachment; filename="uhid.txt"
 
 #
 # old_revision [bdb4e55c6bf540d7f3dea8012f0ea2b929c2e69b]
 #
 # patch "sys/dev/usb/uhidev.c"
 #  from [f79d1c3609a5e0b85227db74ee82e45cab36bf8a]
 #    to [6cb6f4302877f3032082964a88c8881fb7ab138e]
 # 
 # patch "sys/dev/usb/uhidev.h"
 #  from [f34395cbd85e729f736a8288b1d9622082443c55]
 #    to [8badca5b78c7b292fc1923c22ede3e6d17dd95dc]
 #
 ============================================================
 --- sys/dev/usb/uhidev.c       f79d1c3609a5e0b85227db74ee82e45cab36bf8a
 +++ sys/dev/usb/uhidev.c       6cb6f4302877f3032082964a88c8881fb7ab138e
 @@ -103,7 +103,8 @@ USB_ATTACH(uhidev)
        usb_interface_descriptor_t *id;
        usb_endpoint_descriptor_t *ed;
        struct uhidev_attach_arg uha;
 -      struct uhidev *dev;
 +      device_t dev;
 +      struct uhidev *csc;
        int size, nrepid, repid, repsz;
        int *repsizes;
        int i;
 @@ -290,16 +291,17 @@ nomem:
                        uha.reportid = repid;
                        locs[UHIDBUSCF_REPORTID] = repid;
  
 -                      dev = device_private(config_found_sm_loc(self,
 +                      dev = config_found_sm_loc(self,
                                "uhidbus", locs, &uha,
 -                              uhidevprint, config_stdsubmatch));
 +                              uhidevprint, config_stdsubmatch);
                        sc->sc_subdevs[repid] = dev;
                        if (dev != NULL) {
 -                              dev->sc_in_rep_size = repsizes[repid];
 +                              csc = device_private(dev);
 +                              csc->sc_in_rep_size = repsizes[repid];
  #ifdef DIAGNOSTIC
                                DPRINTF(("uhidev_match: repid=%d dev=%p\n",
                                         repid, dev));
 -                              if (dev->sc_intr == NULL) {
 +                              if (csc->sc_intr == NULL) {
                                        free(repsizes, M_TEMP);
                                        aprint_error_dev(self,
                                            "sc_intr == NULL\n");
 @@ -307,8 +309,8 @@ nomem:
                                }
  #endif
  #if NRND > 0
 -                              rnd_attach_source(&dev->rnd_source,
 -                                                USBDEVNAME(dev->sc_dev),
 +                              rnd_attach_source(&csc->rnd_source,
 +                                                USBDEVNAME(dev),
                                                  RND_TYPE_TTY, 0);
  #endif
                        }
 @@ -362,7 +364,7 @@ uhidev_activate(device_t self, enum deva
                for (i = 0; i < sc->sc_nrepid; i++)
                        if (sc->sc_subdevs[i] != NULL)
                                rv |= config_deactivate(
 -                                      sc->sc_subdevs[i]->sc_dev);
 +                                      sc->sc_subdevs[i]);
                sc->sc_dying = 1;
                break;
        default:
 @@ -379,7 +381,7 @@ uhidev_childdet(device_t self, device_t 
        struct uhidev_softc *sc = device_private(self);
  
        for (i = 0; i < sc->sc_nrepid; i++) {
 -              if (sc->sc_subdevs[i]->sc_dev == child)
 +              if (sc->sc_subdevs[i] == child)
                        break;
        }
        KASSERT(i < sc->sc_nrepid);
 @@ -390,6 +392,9 @@ USB_DETACH(uhidev)
  {
        USB_DETACH_START(uhidev, sc);
        int i, rv;
 +#if NRND > 0
 +      struct uhidev *csc;
 +#endif
  
        DPRINTF(("uhidev_detach: sc=%p flags=%d\n", sc, flags));
  
 @@ -404,9 +409,10 @@ USB_DETACH(uhidev)
        for (i = 0; i < sc->sc_nrepid; i++) {
                if (sc->sc_subdevs[i] != NULL) {
  #if NRND > 0
 -                      rnd_detach_source(&sc->sc_subdevs[i]->rnd_source);
 +                      csc = device_private(sc->sc_subdevs[i]);
 +                      rnd_detach_source(&csc->rnd_source);
  #endif
 -                      rv |= config_detach(sc->sc_subdevs[i]->sc_dev, flags);
 +                      rv |= config_detach(sc->sc_subdevs[i], flags);
                }
        }
  
 @@ -422,6 +428,7 @@ uhidev_intr(usbd_xfer_handle xfer, usbd_
  uhidev_intr(usbd_xfer_handle xfer, usbd_private_handle addr, usbd_status 
status)
  {
        struct uhidev_softc *sc = addr;
 +      device_t cdev;
        struct uhidev *scd;
        u_char *p;
        u_int rep;
 @@ -460,10 +467,13 @@ uhidev_intr(usbd_xfer_handle xfer, usbd_
                printf("uhidev_intr: bad repid %d\n", rep);
                return;
        }
 -      scd = sc->sc_subdevs[rep];
 +      cdev = sc->sc_subdevs[rep];
 +      if (!cdev)
 +              return;
 +      scd = device_private(cdev);
        DPRINTFN(5,("uhidev_intr: rep=%d, scd=%p state=0x%x\n",
                    rep, scd, scd ? scd->sc_state : 0));
 -      if (scd == NULL || !(scd->sc_state & UHIDEV_OPEN))
 +      if (!(scd->sc_state & UHIDEV_OPEN))
                return;
        if (scd->sc_in_rep_size != cc) {
                printf("%s: bad input length %d != %d\n",
 ============================================================
 --- sys/dev/usb/uhidev.h       f34395cbd85e729f736a8288b1d9622082443c55
 +++ sys/dev/usb/uhidev.h       8badca5b78c7b292fc1923c22ede3e6d17dd95dc
 @@ -53,7 +53,7 @@ struct uhidev_softc {
        int sc_repdesc_size;
  
        u_int sc_nrepid;
 -      struct uhidev **sc_subdevs;
 +      device_t *sc_subdevs;
  
        int sc_refcnt;
        u_char sc_dying;
 
 --==_Exmh_10470162210690--