kern/50149: ehci panic when pluging in a USB disk

[martin%NetBSD.org@localhost]

>Number:         50149
>Category:       kern
>Synopsis:       ehci panic when pluging in a USB disk
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 17 09:45:00 +0000 2015
>Originator:     Martin Husemann
>Release:        NetBSD 7.99.20
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD night-owl.duskware.de 7.99.20 NetBSD 7.99.20 (NIGHT-OWL) #342: Fri Aug 14 19:58:59 CEST 2015 martin%night-owl.duskware.de@localhost:/usr/src/sys/arch/amd64/compile/NIGHT-OWL amd64
Architecture: x86_64
Machine: amd64
>Description:

When pluging in a USB disk while the system has been running for a while,
I got this panic:

KASSERT fired:

#11 0xffffffff807e92e8 in usb_dmaaddr (dma=dma@entry=0xfffffe8115211d70, 
    offset=65536, offset@entry=0) at ../../../../dev/usb/usb_mem.c:403
#12 0xffffffff802bd0bb in ehci_alloc_sqtd_chain (
    epipe=epipe@entry=0xfffffe812a9752d8, sc=sc@entry=0xfffffe81072b2008, 
    alen=36, rd=1, xfer=xfer@entry=0xfffffe8115211cf8, 
    sp=sp@entry=0xfffffe80bf716df0, ep=ep@entry=0xfffffe80bf716df8)
    at ../../../../dev/usb/ehci.c:2973
#13 0xffffffff802be2f0 in ehci_device_bulk_start (xfer=0xfffffe8115211cf8)
    at ../../../../dev/usb/ehci.c:3767
#14 0xffffffff807eb94f in usbd_transfer (xfer=xfer@entry=0xfffffe8115211cf8)
    at ../../../../dev/usb/usbdi.c:325
#15 0xffffffff807dea7e in umass_setup_transfer (
    sc=sc@entry=0xfffffe8125983e48, pipe=<optimized out>, 
    buffer=<optimized out>, buflen=<optimized out>, flags=flags@entry=5, 
    xfer=0xfffffe8115211cf8) at ../../../../dev/usb/umass.c:829
#16 0xffffffff807df24d in umass_setup_transfer (xfer=<optimized out>, flags=5, 
    buflen=<optimized out>, buffer=<optimized out>, pipe=<optimized out>, 
    sc=0xfffffe8125983e48) at ../../../../dev/usb/umass.c:1364
#17 umass_bbb_state (xfer=0xfffffe8115211e68, priv=0xfffffe8125983e48, 
    err=USBD_NORMAL_COMPLETION) at ../../../../dev/usb/umass.c:1118
#18 0xffffffff807ec480 in usb_transfer_complete (
    xfer=xfer@entry=0xfffffe8115211e68) at ../../../../dev/usb/usbdi.c:931
#19 0xffffffff802bc6bc in ehci_idone (ex=ex@entry=0xfffffe8115211e68)
    at ../../../../dev/usb/ehci.c:1135
#20 0xffffffff802bca6a in ehci_check_qh_intr (ex=<optimized out>, 
    sc=<optimized out>) at ../../../../dev/usb/ehci.c:905
#21 ehci_check_intr (ex=0xfffffe8115211e68, sc=0xfffffe81072b2008)
    at ../../../../dev/usb/ehci.c:814
#22 ehci_softintr (v=<optimized out>) at ../../../../dev/usb/ehci.c:784
#23 0xffffffff807e79ce in usb_soft_intr (arg=0xfffffe81072b2048)
    at ../../../../dev/usb/usb.c:1025
#24 0xffffffff804d6338 in softint_execute (l=<optimized out>, s=4, 
    si=0xffff800045ea3230) at ../../../../kern/kern_softint.c:589
#25 softint_dispatch (
    pinned=<error reading variable: Cannot access memory at address 0xfffffe80bf7170c0>, s=4) at ../../../../kern/kern_softint.c:871
#26 0xffffffff8011412f in Xsoftintr ()

Both offset and size are 64k:

(gdb) p offset
$2 = 65536
(gdb) p dma->block->size
$3 = 65536

The device, when pluged in at boot, works fine:

umass0 at uhub3 port 1 configuration 1 interface 0
umass0: vendor 13fe USB DISK 2.0, rev 2.00/1.00, addr 3
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <, USB DISK 2.0, PMAP> disk removable
sd0: 15272 MB, 3832 cyl, 255 head, 32 sec, 512 bytes/sect x 31277056 sectors


>How-To-Repeat:
s/a

>Fix:
n/a