kern/77940: insertion of usb keyboard panics system

[Jonathan Hanna]

>Number:         77940
>Category:       kern
>Synopsis:       insertion of usb keyboard panics system
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Feb 23 01:40:15 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Jonathan Hanna
>Release:        FreeBSD 6.0-CURRENT i386
>Organization:
>Environment:

FreeBSD 6.0-CURRENT
Thought to affect all branches.

>Description:

Insertion of or boot with a
ukbd0: Solid Year USB MINI Keyboard, rev 1.10/0.31, addr 2, iclass 3/1
panics the system.

The stack trace is roughly:
	usdb_get_interface_descriptor()	(iface is NULL)
	ukbd_attach()
	device_attach()
	usbd_new_device()
	uhub_explore()
	usb_discover()
	...

It seems that the usbd_set_protocol() fails and cuases
USB_ATTACH(ukbd) in ukbd.c to eventually to be called
with uaa->iface==NULL and uaa->usegeneric==1. When
USB_ATTACH(ukbd) does "id = usbd_get_interface_descriptor(iface)"
the NULL iface is dereferenced. The "id" does not seem to
be used and may be a holdover from old debugging.

May be related to usb/76847.

>How-To-Repeat:

>Fix:

A work-around is:
RCS file: /usr/ncvs/src/sys/dev/usb/usb_quirks.c,v
retrieving revision 1.40
diff -u -r1.40 usb_quirks.c
--- usb_quirks.c        3 Sep 2004 23:19:27 -0000       1.40
+++ usb_quirks.c        23 Feb 2005 00:28:42 -0000
@@ -101,6 +101,7 @@
        ANY, { UQ_ASSUME_CM_OVER_DATA }},
  { USB_VENDOR_SUNTAC, USB_PRODUCT_SUNTAC_AS64LX,
        0x100, { UQ_ASSUME_CM_OVER_DATA }},
+ { USB_VENDOR_SOLIDYEAR, 22785, 49, {UQ_NO_SET_PROTO}},
  { 0, 0, 0, { 0 } }
 };

NetBSD removed the usbd_set_protocol() code from ukbd.c in their
revision 1.75 of Fri Dec 28 17:32:36 2001. Perhaps it should be
removed in FreeBSD, though that seemed to be part of some fairly
extensive changes.
>Release-Note:
>Audit-Trail:
>Unformatted: