kern/42848: Kernel Panic while opening ttyU? or dtyU? with open() C function

[lugarbleiz%gmail.com@localhost]

>Number:         42848
>Category:       kern
>Synopsis:       Kernel Panic while opening ttyU? or dtyU? with open() C 
>function
>Confidential:   no
>Severity:       critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Feb 19 20:40:00 +0000 2010
>Originator:     Thomas Nivelet
>Release:        NetBSD-current (2nd february 2010)
>Organization:
>Environment:
NetBSD  5.99.24 NetBSD 5.99.24 (GENERIC) #0: Tue Feb  2 10:36:02 UTC 2010  
builds%b7.netbsd.org@localhost:/home/builds/ab/HEAD/i386/201002020000Z-obj/home/builds/ab/HEAD/src/sys/arch/i386/compile/GENERIC
 i386
>Description:
when trying to open ttyU? with the C function like this:
open(fd, tty, O_RDONLY); with tty as an existing ttyU? it can't open the first 
ttyU and wait for it to be ready even if a umodem is connected to the system 
and crash if the umodem is disconnected while it's wait
with it's non-blocking version (dtyU?) it crash even if the device is still 
connected.

usb_transfer_complete(c1f79700,16e0,10,a,cb166f80,c1f6b640,0,c1f79700,c2012280,0)
at netbsd:usb_transfer_complete+0x3f
uhci_idone(c1f79754,16b4,4,a,8,28000000,cbad9000,c1f7977c,0,cbb226e0)
at netbsd:uhci_idone+0xb6
uhci_softintr(cbad9004,0,0,0,0,0,1000000,3,0,0) at netbsd:uhci_softintr+0x1af
softint_dispatch(cb16ec80,4,ffffffff,dfffffff,0,20000000,cb591d90,cb591d28,cb16ea00,0)
at netbsd:softint_dispatch+0x70
DDB lost frame for netbsd:Xsoftintr+0x3b, trying 0xcb591d88
Xsoftintr() at netbsd:Xsoftintr+0x3b
fatal page fault i supervisor mode
trap type 6 code 0 eip c02454e0 cs 8 eflags 10246 cr 2 ffffffff ilevel 8
kernel: supervisor trap page fault, code=0
faulted in DDB; continuing...
>How-To-Repeat:
just make a test application which open a ttyU? or a dtyU?, with the C function 
open(), compile, connect a umodem device and launch the application. if the 
ttyU has been chosen, disconnect the device while the software is still running.

Jeremy C. Reed asked me to test if it crash on NetBSD 5.0.2 before sending this 
PR, and unfortunately it crash on it too.

here is my own faulty code (in c++):

  while ((dirp = readdir(dp)) != NULL)
    {
      file = std::string(dirp->d_name);
      if (file.find("ttyU") != std::string::npos)
        {
          file = "/dev/" + file;
          devicefd = open(file.c_str(), O_RDONLY);
          if (devicefd != -1)
              if (ioctl(devicefd, USB_GET_DEVICE_DESC, &udd) != -1)
                std::cout << "there is " << 
static_cast<int>(udd.bNumConfigurations) << " configuration o
n this device" << std::endl;
        }
    }

>Fix: