kern/57255: usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10

[abs%absd.org@localhost]

>Number:         57255
>Category:       kern
>Synopsis:       usbdi SIMPLEQ_FIRST(&pipe->up_queue) panic in NetBSD-10
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Mar 03 11:15:00 +0000 2023
>Originator:     David Brownlee
>Release:        10.0_BETA
>Organization:
-
>Environment:
NetBSD forsaken.absd.org 10.0_BETA NetBSD 10.0_BETA (GENERIC) #0: Fri Feb 24 14:16:10 UTC 2023  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
System panics on startup, shortly after login to X. First seen shortly after Jan 6, but appeared to clear up. Now seen with 2023-02-24 netbsd-10 build from ntftp

Three successive panics this morning:
- After first the machine was shut down before booting
- After second USB mouse dongles were removed
- After third external USB multifunction hub was disconnected, and system booted without panic. I _may_ have seen the similar panic in early January without hub, so while likely relevant, its not 100%.

panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xffff915f802a2198 is not start of queue (0xffff915f802a2058 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa2884e9d90f0
Xsoftintr() at netbsd:Xsoftintr+0x4c

panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xffff8fb629250698 is not start of queue (0xffff8fb6275df688 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
cpu0: End traceback...

panic: kernel diagnostic assertion "xfer == SIMPLEQ_FIRST(&pipe->up_queue)" failed: file "/usr/src/sys/dev/usb/usbdi.c", line 1142 xfer 0xfffffc557e570698 is not start of queue (0xfffffc557a389400 is at start)
cpu0: Begin traceback...
vpanic() at netbsd:vpanic+0x183
kern_assert() at netbsd:kern_assert+0x4b
usb_transfer_complete() at netbsd:usb_transfer_complete+0x44d
xhci_softintr() at netbsd:xhci_softintr+0x4ea
usb_soft_intr() at netbsd:usb_soft_intr+0x25
softint_dispatch() at netbsd:softint_dispatch+0x10b
DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffa3884e9d90f0
Xsoftintr() at netbsd:Xsoftintr+0x4c

If it is the hub, this is how it identifies - definitely "multifunction"

uhub4 at uhub1 port 4: VIA Labs, Inc. (0x2109) USB2.0 Hub (0x2822), class 9/0, rev 2.10/6.a3, addr 2
uhub4: multiple transaction translators
uhub4: 5 ports with 4 removable, self powered
uhub5 at uhub0 port 4: VIA Labs, Inc. (0x2109) USB3.1 Hub (0x0822), class 9/0, rev 3.20/6.a3, addr 3
uhub5: 4 ports with 4 removable, self powered
uhub6 at uhub4 port 1: VIA Labs, Inc. (0x2109) USB2.0 Hub (0x2815), class 9/0, rev 2.10/7.04, addr 4
uhub6: multiple transaction translators
uhub6: 4 ports with 4 removable, self powered
uhub7 at uhub5 port 1: VIA Labs, Inc. (0x2109) USB3.0 Hub (0x0815), class 9/0, rev 3.20/7.04, addr 5
uhub7: 4 ports with 4 removable, self powered
uaudio0 at uhub6 port 1 configuration 1 interface 0
uaudio0: vendor 0c76 (0x0c76) USB PnP Audio Device (0x153f), rev 1.10/1.00, addr 6
uaudio0: audio rev 1.00
audio2 at uaudio0: playback, capture, full duplex, independent
audio2: slinear_le:16 2ch 48000Hz, blk 11520 bytes (60ms) for playback
audio2: slinear_le:16 1ch 48000Hz, blk 12000 bytes (125ms) for recording
spkr3 at audio2: PC Speaker (synthesized)
wsbell at spkr3 not configured
uhidev0 at uhub6 port 1 configuration 1 interface 3
uhidev0: vendor 0c76 (0x0c76) USB PnP Audio Device (0x153f), rev 1.10/1.00, addr 6, iclass 3/0
uhid0 at uhidev0: input=4, output=4, feature=0
umass1 at uhub7 port 2 configuration 1 interface 0
umass1: Generic (0x05e3) USB3.0 Card Reader (0x0749), rev 3.20/15.39, addr 7
umass1: using SCSI over Bulk-Only
scsibus1 at umass1: 2 targets, 2 luns per target
sd1 at scsibus1 target 0 lun 0: <Generic, MassStorageClass, 1539> disk removable
sd1: drive offline
sd2 at scsibus1 target 0 lun 1: <Generic, MassStorageClass, 1539> disk removable
sd2: drive offline
umass2 at uhub4 port 2 configuration 1 interface 0
umass2: Realtek (0x0bda) RTL9210B-CG (0x9210), rev 2.10/20.01, addr 8
umass2: using SCSI over Bulk-Only
scsibus2 at umass2: 2 targets, 1 lun per target
sd3 at scsibus2 target 0 lun 0: <Realtek, RTL9210, 1.00> disk fixed
sd3(umass2:0:0:0):  Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
    SENSE KEY:  Illegal Request
     ASC/ASCQ:  Invalid Command Operation Code
sd3: drive offline
sd3(umass2:0:0:0):  Check Condition on CDB: 0x23 00 00 00 00 00 00 00 0c 00
    SENSE KEY:  Illegal Request
     ASC/ASCQ:  Invalid Command Operation Code
autoconfiguration error: sd3: unable to open device, error = 6
ure0 at uhub7 port 3
ure0: Realtek (0x0bda) USB 10/100/1000 LAN (0x8153), rev 3.00/30.00, addr 9
ure0: RTL8153 ver 5c30
rgephy0 at ure0 phy 0: RTL8251 1000BASE-T media interface, rev. 0
rgephy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT-FDX, auto
ure0: Ethernet address 00:e0:4c:68:0d:e3
ugen0 at uhub4 port 5
ugen0: VIA Labs, Inc. (0x2109) USB Billboard Device (0x8818), rev 2.01/0.01, addr 10

Will try to test a current kernel, and a current kernel+DEBUG
>How-To-Repeat:
Boot netbsd-10 on ThinkPad T480 (most likely with attached hub), login & wait to see if panics
>Fix:
Never seen in kernel from Jan 6 (but may just be timing)