Crash with USBD_NEXT on NUCLEO_F756GZ

[dsch]

Describe the bug

I'm trying CANnectivity on a NUCLEO-F756ZG board. As soon as the Linux driver tries to access the device an assert get triggered.

I'm using the Zephyr version from PR zephyrproject-rtos/zephyr#80820 to workaround zephyrproject-rtos/zephyr#61464.

To Reproduce

Steps to reproduce the behavior:

1. apply patch

diff --git a/app/boards/nucleo_f756zg.overlay b/app/boards/nucleo_f756zg.overlay
new file mode 100644
index 0000000..3f46516
--- /dev/null
+++ b/app/boards/nucleo_f756zg.overlay
@@ -0,0 +1,34 @@
+#include <zephyr/dt-bindings/gpio/gpio.h>
+
+/ {
+       cannectivity: cannectivity {
+               compatible = "cannectivity";
+               timestamp-counter = <&counter2>;
+
+               channel0 {
+                       compatible = "cannectivity-channel";
+                       can-controller = <&can1>;
+                       state-gpios = <&gpiob 0 GPIO_ACTIVE_HIGH>;
+                       activity-gpios = <&gpioe 1 GPIO_ACTIVE_HIGH>;
+               };
+       };
+};
+
+&zephyr_udc0 {
+       gs_usb0: gs_usb0 {
+               compatible = "gs_usb";
+       };
+};
+
+&can1 {
+       status = "okay";
+       pinctrl-0 = <&can1_rx_pd0 &can1_tx_pd1>;
+       pinctrl-names = "default";
+};
+
+&timers2 {
+       st,prescaler = <107>;
+       counter2: counter {
+               status = "okay";
+       };
+};
diff --git a/app/prj_usbd_next.conf b/app/prj_usbd_next.conf
index fafa703..4fc4a3f 100644
--- a/app/prj_usbd_next.conf
+++ b/app/prj_usbd_next.conf
@@ -5,6 +5,9 @@ CONFIG_USBD_GS_USB_LOG_LEVEL_DBG=y
 CONFIG_CANNECTIVITY_LOG_LEVEL_DBG=y
 
 CONFIG_USB_DEVICE_STACK_NEXT=y
+# CONFIG_USB_DEVICE_STACK is not set
 
 CONFIG_CAN=y
 CONFIG_CAN_FD_MODE=y
+
+CONFIG_ASSERT=y

2. west build -b nucleo_f756zg --extra-conf prj_usbd_next.conf custom/cannectivity/app
3. west flash
4. connect to host

Expected behavior

No crash

Logs and console output

Zephyr:

*** Booting Zephyr OS build v4.0.0-1636-g8e5532dc1863 ***
*** CANnectivity firmware version 1.1.0-dev ***
[00:00:00.000,000] <dbg> gs_usb: gs_usb_register_channel: channel 0 features = 0x0000203b
[00:00:00.010,000] <dbg> gs_usb: gs_usb_init: initialized class instance 0x20010c18, interface number 0
[00:00:00.010,000] <inf> main: CANnectivity firmware initialized with 1 channel

[00:00:05.749,000] <dbg> gs_usb: gs_usb_enable: enabled
ASSERTION FAIL [net_buf_simple_tailroom(buf) >= len] @ WEST_TOPDIR/zephyr/lib/net_buf/buf_simple.c:62
[00:00:05.750,000] <err> os: r0/a1:  0x00000004  r1/a2:  0x0000003e  r2/a3:  0x00000002
[00:00:05.750,000] <err> os: r3/a4:  0x00000004 r12/ip:  0x00001676 r14/lr:  0x080041fd
[00:00:05.750,000] <err> os:  xpsr:  0x01000000
[00:00:05.750,000] <err> os: Faulting instruction address (r15/pc): 0x0800fbb2
[00:00:05.750,000] <err> os: >>> ZEPHYR FATAL ERROR 4: Kernel panic on CPU 0
[00:00:05.750,000] <err> os: Current thread: 0x20011bc0 (unknown)
[00:00:05.810,000] <err> os: Halting system

Linux:

[16844.222085] usb 3-3.3: new full-speed USB device number 29 using xhci_hcd
[16849.704731] usb 3-3.3: New USB device found, idVendor=1209, idProduct=ca01, bcdDevice= 1.01
[16849.704736] usb 3-3.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[16849.704738] usb 3-3.3: Product: CANnectivity USB to CAN adapter
[16849.704740] usb 3-3.3: Manufacturer: CANnectivity
[16849.704740] usb 3-3.3: SerialNumber: 333237323233510D00330035
[16850.727238] gs_usb 3-3.3:1.0: Couldn't send data format (err=-110)
[16850.727253] gs_usb: probe of 3-3.3:1.0 failed with error -110

Environment

• Target board: nucleo_f756zg
• OS: Ubuntu 24.04
• Toolchain: zephyr-sdk-0.16.8
• CANnectivity Git commit SHA: bba877b
• Zephyr RTOS Git commit SHA: topisani/zephyr@8e5532d

Additional context

I'm not sure if this is the right place to report this issue as I could not find the culprit. As @henrikbrixandersen is involved in both sides I'm posting it here as this project is less noisy.

[henrikbrixandersen]

2. west build -b nucleo_f756zg --extra-conf prj_usbd_next.conf custom/cannectivity/app

Tip: A more correct way to build for this configuration would be be:
west build -b nucleo_f756zg -- -DFILE_SUFFIX=usbd_next -DCONFIG_ASSERT=y

[henrikbrixandersen]

Thank you for reporting this. I have tried to reproduce this on my nucleo_h723zg (I don't have access to a nucleo_f756zg ) without luck. Using the patch from zephyrproject-rtos/zephyr#80820 (topisani/zephyr@8e6c8ae) along with the following command for building produces a firmware, which enumerates as it should under Linux kernel v6.8.0 (Ubuntu 22.04, Aarch64), without throwing any assertions:

west build -b nucleo_h723zg/stm32h723xx app/ -- -DFILE_SUFFIX=usbd_next -DCONFIG_ASSERT=y

What does addr2line -e build/zephyr/zephyr.elf 0x0800fbb2 ("Faulting instruction address (r15/pc)" from the stack trace) point to for the failing build? Can you provide a backtrace from that failing assert?