Re: kern/56099: USB xHCI panic when using microphone

[sc dying <sc.dying%gmail.com@localhost>]

The following reply was made to PR kern/56099; it has been noted by GNATS.

From: sc dying <sc.dying%gmail.com@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: kern-bug-people%netbsd.org@localhost, gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Subject: Re: kern/56099: USB xHCI panic when using microphone
Date: Thu, 29 Apr 2021 06:19:29 +0900

 Does xhci_event_transfer() forget to increment xx_isoc_done and
 avoid calling usb_transfer_comeplete() in error paths?
 When an error occurs while isoc transfer, i.e. completion code is not
 SUCCESS nor SHORT_PKT, usb_transfer_comeplete is called without
 incrementing xx_isoc_done and the xfer is removed from up_queue.
 Then, usb_transfer_comeplete is called at the last of transferring
 ux_frlengths[], but it cannot find the xfer in up_queue and fires KASSERT.