kern/54725: athn(4) triggers LOCKDEBUG panic on reattach

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         54725
>Category:       kern
>Synopsis:       athn(4) triggers LOCKDEBUG panic on reattach
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Nov 30 10:30:00 +0000 2019
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current, source date 2019.11.07.18.35.41
>Organization:

>Environment:
System: NetBSD
Architecture: x86_64
Machine: amd64
>Description:

Plugging in, unplugging, and then replugging an athn(4) device into a
NetBSD-current system with "options LOCKDEBUG" causes a panic.

Backtrace:

(gdb) bt
#0  0xffffffff80222c35 in cpu_reboot (howto=howto@entry=256, bootstr=bootstr@entry=0x0) at /ssd/prod/usbdebug/src/sys/arch/amd64/amd64/machdep.c:720
#1  0xffffffff807e4693 in db_sync_cmd (addr=<optimized out>, have_addr=<optimized out>, count=<optimized out>, modif=<optimized out>)
    at /ssd/prod/usbdebug/src/sys/ddb/db_command.c:1437
#2  0xffffffff807e4f0b in db_command (last_cmdp=last_cmdp@entry=0xffffffff818464c0 <db_last_command>) at /ssd/prod/usbdebug/src/sys/ddb/db_command.c:933
#3  0xffffffff807e5276 in db_command_loop () at /ssd/prod/usbdebug/src/sys/ddb/db_command.c:592
#4  0xffffffff807e8c2a in db_trap (type=type@entry=1, code=code@entry=0) at /ssd/prod/usbdebug/src/sys/ddb/db_trap.c:91
#5  0xffffffff8021f3c5 in kdb_trap (type=type@entry=1, code=code@entry=0, regs=regs@entry=0xffffb7005247b920)
    at /ssd/prod/usbdebug/src/sys/arch/amd64/amd64/db_interface.c:245
#6  0xffffffff802245cd in trap (frame=0xffffb7005247b920) at /ssd/prod/usbdebug/src/sys/arch/amd64/amd64/trap.c:313
#7  0xffffffff8021d593 in alltraps ()
#8  0xffffffff8021ddcd in breakpoint ()
#9  0xffffffff80a68530 in vpanic (fmt=fmt@entry=0xffffffff8140f660 "LOCKDEBUG: %s error: %s,%zu: %s", ap=ap@entry=0xffffb7005247ba58)
    at /ssd/prod/usbdebug/src/sys/kern/subr_prf.c:334
#10 0xffffffff80a685fd in panic (fmt=fmt@entry=0xffffffff8140f660 "LOCKDEBUG: %s error: %s,%zu: %s") at /ssd/prod/usbdebug/src/sys/kern/subr_prf.c:255
#11 0xffffffff80a5d9fb in lockdebug_abort1 (s=0, dopanic=true, msg=0xffffffff8142301b "already initialized", ld=0xffffb70006d3b400, line=129, 
    func=0xffffffff81289560 <__func__.5274> "cv_init") at /ssd/prod/usbdebug/src/sys/kern/subr_lockdebug.c:811
#12 lockdebug_abort1 (func=0xffffffff81289560 <__func__.5274> "cv_init", line=129, ld=0xffffb70006d3b400, s=0, msg=0xffffffff8142301b "already initialized", 
    dopanic=<optimized out>) at /ssd/prod/usbdebug/src/sys/kern/subr_lockdebug.c:789
#13 0xffffffff80a5dca2 in lockdebug_alloc (func=func@entry=0xffffffff81289560 <__func__.5274> "cv_init", line=line@entry=129, lock=lock@entry=0xffffb700060c7cb8, 
    lo=lo@entry=0xffffffff8185c680 <cv_lockops>, initaddr=18446744071567355960) at /ssd/prod/usbdebug/src/sys/kern/subr_lockdebug.c:263
#14 0xffffffff809fab4e in cv_init (cv=cv@entry=0xffffb700060c7cb8, wmesg=wmesg@entry=0xffffffff8139b832 "athnhtc") at /ssd/prod/usbdebug/src/sys/kern/kern_condvar.c:128
#15 0xffffffff8050b038 in athn_usb_attach (parent=<optimized out>, self=0xffff999d491737c8, aux=0xffffb7005247bce8) at /ssd/prod/usbdebug/src/sys/dev/usb/if_athn_usb.c:280
#16 0xffffffff80a4c05d in config_attach_loc (parent=parent@entry=0xffff999ce0e4b088, cf=<optimized out>, cf@entry=0xffffffff81891470 <cfdata+11184>, 
    locs=locs@entry=0xffffb7005247bcd0, aux=aux@entry=0xffffb7005247bce8, print=print@entry=0xffffffff80487208 <usbd_print>)
    at /ssd/prod/usbdebug/src/sys/kern/subr_autoconf.c:1602
#17 0xffffffff80a4c176 in config_found_sm_loc (parent=parent@entry=0xffff999ce0e4b088, ifattr=ifattr@entry=0xffffffff81390bd3 "usbdevif", 
    locs=locs@entry=0xffffb7005247bcd0, aux=aux@entry=0xffffb7005247bce8, print=print@entry=0xffffffff80487208 <usbd_print>, submatch=<optimized out>)
    at /ssd/prod/usbdebug/src/sys/kern/subr_autoconf.c:1098
#18 0xffffffff80486ae8 in usbd_attachwholedevice (parent=parent@entry=0xffff999ce0e4b088, dev=dev@entry=0xffff999d49076158, port=port@entry=2, usegeneric=usegeneric@entry=0)
    at /ssd/prod/usbdebug/src/sys/dev/usb/usb_subr.c:950
#19 0xffffffff80489a66 in usbd_probe_and_attach (parent=parent@entry=0xffff999ce0e4b088, dev=dev@entry=0xffff999d49076158, port=port@entry=2, addr=2)
    at /ssd/prod/usbdebug/src/sys/dev/usb/usb_subr.c:1065
#20 0xffffffff806b2d13 in xhci_new_device (parent=<optimized out>, bus=<optimized out>, depth=<optimized out>, speed=<optimized out>, port=<optimized out>, 
    up=<optimized out>) at /ssd/prod/usbdebug/src/sys/dev/usb/xhci.c:2534
#21 0xffffffff8048af6d in usbd_new_device (parent=0xffff999ce0e4b088, bus=0xffff999ce05a34f8, depth=1, speed=3, port=port@entry=2, up=up@entry=0xffff999ce0e500a8)
    at /ssd/prod/usbdebug/src/sys/dev/usb/usb_subr.c:1219
#22 0xffffffff804903fe in uhub_explore (dev=0xffff999d4a583ec0) at /ssd/prod/usbdebug/src/sys/dev/usb/uhub.c:759
#23 0xffffffff8047ddcb in usb_discover (sc=sc@entry=0xffff999d498876d8) at /ssd/prod/usbdebug/src/sys/dev/usb/usb.c:1006
#24 0xffffffff8047e119 in usb_event_thread (arg=0xffff999d498876d8) at /ssd/prod/usbdebug/src/sys/dev/usb/usb.c:564
#25 0xffffffff80209787 in lwp_trampoline ()
#26 0x0000000000000000 in ?? ()
(gdb) 

The device used was a "Comfast CF-WU871N USB Wireless Adapter",
identified as follows in the dmesg attach messages:

[  3758.261161] athn0 at uhub1 port 2
[  3759.229435] : Atheros AR9271
[  3759.229435] athn0: rev 1 (1T1R), ROM rev 15, address 48:5d:60:57:7d:4f

>How-To-Repeat:

>Fix: