kern/54728: urtwn(4) locks up on WPA2 reconfiguration

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         54728
>Category:       kern
>Synopsis:       urtwn(4) locks up on WPA2 reconfiguration
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Dec 01 12:00:00 +0000 2019
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current, source date 2019.11.29.14.15.41
>Organization:

>Environment:
System: NetBSD
Architecture: x86_64
Machine: amd64
>Description:

The urtwn(4) driver hangs when a RTL8188CUS based USB WiFi adapter is
configured with WPA2 encryption for the second time.  I have three such
adapters and it happens consistently with all of them, with multiple
USB host controller types (OHCI, EHCI, XHCI).

A RTL8188EU based adapter fails differently, and adapters on UHCI also
fail differently; those failures are outside the scope of this PR.

To reproduce:

In the unlikely case that you don't already have a WiFi access point
using WPA2 encryption, set one up.

Save the following as test-wpa2.sh and edit the IP addresses and masks
to match your access point configuration.  Set ap_ip and ap_mask to
the IP address and netmask of the access point, respectively, and
our_ip to any unused IP address on the same network.

#!/bin/sh
set -ex
wifi_if="$1"
ap_ip=192.168.100.1
ap_mask=255.255.255.0
our_ip=192.168.100.2
wpa_supplicant -i $wifi_if -c ./wpa_supplicant.conf >wpa_supplicant.log &
ifconfig $wifi_if $our_ip netmask $ap_mask
ifconfig $wifi_if up
ping -n -c 20 $ap_ip
wpa_cli terminate
sleep 5
ifconfig $wifi_if down
echo "pass"

Save the following as ./wpa_supplicant.conf and edit the SSID and
password to match your access point configuration:

ctrl_interface=/var/run/wpa_supplicant/
ctrl_interface_group=wheel
network={
        ssid="YOUR_SSID_HERE"
        psk="YOUR_WIFI_PASSWORD_HERE"
}

Plug in a urtwn(4) USB WiFi adapter.

Run

  sh test-wpa2.sh urtwn0

This is expected to succeed and print "pass" at the end.  Note that it
is normal to lose about half the ping packets while the interface is
being configured.

Then run the script again:

  sh test-wpa2.sh urtwn0

This time, the script will fail, and the console will log the
message "urtwn0: timeout waiting for firmware readiness".

I can send adapters to the first two developers who express a
serious interest in investigating this bug, for free and with
no need to return them.

>How-To-Repeat:

See above.

>Fix: