NetBSD Problem Report #56194

From www@netbsd.org  Fri May 21 15:11:48 2021
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 0BCF81A9249
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 21 May 2021 15:11:48 +0000 (UTC)
Message-Id: <20210521151146.B20541A925E@mollari.NetBSD.org>
Date: Fri, 21 May 2021 15:11:46 +0000 (UTC)
From: nia@pkgsrc.org
Reply-To: nia@pkgsrc.org
To: gnats-bugs@NetBSD.org
Subject: xhci panic: kernel diagnostic assertion "xs->xs_xr[dci] == NULL" failed
X-Send-Pr-Version: www-1.0

>Number:         56194
>Category:       kern
>Synopsis:       xhci panic: kernel diagnostic assertion "xs->xs_xr[dci] == NULL" failed
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri May 21 15:15:00 +0000 2021
>Closed-Date:    
>Last-Modified:  Sat Jan 20 13:09:28 +0000 2024
>Originator:     nia
>Release:        current
>Organization:
The NetBSD Foundation
>Environment:
NetBSD amnesia 9.99.82 NetBSD 9.99.82 (NIAAMD64) #2: Tue May 18 12:32:39 CEST 2021  nia@amnesia:/src/obj/sys/arch/amd64/compile/NIAAMD64 amd64
>Description:
The system gradually locked up over a few seconds while using uaudio
for output, then eventually panicked:

System panicked: kernel diagnostic assertion "xs->xs_xr[dci] == NULL" failed: file "/src/src/sys/dev/usb/xhci.c", line 1669

This is an older uaudio device that worked before Isochronous Pipe
support was introduced:

$ dmesg | grep uaudio
[   756.135042] uaudio0 at uhub1 port 2 configuration 1 interface 0
[   756.135042] uaudio0: C-Media Electronics Inc. (0x0d8c) USB Audio Device (0x0014), rev 1.10/1.00, addr 2
[   756.135042] uaudio0: audio rev 1.00
[   756.135042] audio1 at uaudio0: playback, capture, full duplex, independent
$ audiocfg list
0: [*] audio1 @ uaudio0: USB audio
       playback: 2ch, 48000Hz
       record:   1ch, 48000Hz
       (P-) slinear_le 16/16, 2ch, { 48000, 44100 }
       (-R) slinear_le 16/16, 1ch, { 48000, 44100 }


Unfortunately the core dump is invalid and most tools dump themselves
while trying to read it - kernel memory corruption?
>How-To-Repeat:

>Fix:

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: kern-bug-people->jdolecek
Responsible-Changed-By: jdolecek@NetBSD.org
Responsible-Changed-When: Fri, 21 May 2021 19:36:46 +0000
Responsible-Changed-Why:
I'm looking on xhci(4), can check this one too.


State-Changed-From-To: open->feedback
State-Changed-By: jdolecek@NetBSD.org
State-Changed-When: Sun, 06 Jun 2021 18:38:08 +0000
State-Changed-Why:
Can you check if the change fixes the problem?


From: "Jaromir Dolecek" <jdolecek@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/56194 CVS commit: src/sys/dev/usb
Date: Sun, 6 Jun 2021 18:37:20 +0000

 Module Name:	src
 Committed By:	jdolecek
 Date:		Sun Jun  6 18:37:20 UTC 2021

 Modified Files:
 	src/sys/dev/usb: xhci.c

 Log Message:
 also reset xs->xs_xr[dci] to NULL when closing the pipe

 avoids KASSERT() on next xhci_open()

 should fix PR kern/56194 by nia


 To generate a diff of this commit:
 cvs rdiff -u -r1.143 -r1.144 src/sys/dev/usb/xhci.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: feedback->open
State-Changed-By: nia@NetBSD.org
State-Changed-When: Thu, 15 Jul 2021 08:08:45 +0000
State-Changed-Why:
Problem is still present as of yesterday's HEAD.


Responsible-Changed-From-To: jdolecek->kern-bug-people
Responsible-Changed-By: jdolecek@NetBSD.org
Responsible-Changed-When: Sat, 20 Jan 2024 13:09:28 +0000
Responsible-Changed-Why:
Somebody else needs to investigate.


>Unformatted:

Home	PR Database Search