From jhary@unsane.co.uk  Mon Mar 31 10:00:00 2008
Return-Path: <jhary@unsane.co.uk>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id D2399106564A
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 31 Mar 2008 10:00:00 +0000 (UTC)
	(envelope-from jhary@unsane.co.uk)
Received: from unsane.co.uk (unknown [IPv6:2001:470:1f08:110::2])
	by mx1.freebsd.org (Postfix) with ESMTP id 6CE1C8FC23
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 31 Mar 2008 10:00:00 +0000 (UTC)
	(envelope-from jhary@unsane.co.uk)
Received: from unsane.co.uk (localhost [127.0.0.1])
	by unsane.co.uk (8.14.0/8.14.0) with ESMTP id m2V9xqNW061805
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 31 Mar 2008 10:59:52 +0100 (BST)
	(envelope-from jhary@unsane.co.uk)
Received: (from jhary@localhost)
	by unsane.co.uk (8.14.0/8.14.0/Submit) id m2V9xqxu061804;
	Mon, 31 Mar 2008 10:59:52 +0100 (BST)
	(envelope-from jhary)
Message-Id: <200803310959.m2V9xqxu061804@unsane.co.uk>
Date: Mon, 31 Mar 2008 10:59:52 +0100 (BST)
From: Vince Hoffman <jhary@unsane.co.uk>
Reply-To: Vince Hoffman <jhary@unsane.co.uk>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: Removal of usb serial Device with session (eg tip) attached panics system
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         122287
>Category:       kern
>Synopsis:       Removal of usb serial Device with session (eg tip) attached panics system
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kib
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Mar 31 10:00:06 UTC 2008
>Closed-Date:    Fri May 16 11:52:49 UTC 2008
>Last-Modified:  Fri May 16 11:52:49 UTC 2008
>Originator:     Vince Hoffman
>Release:        FreeBSD 7.0-STABLE  #52
>Organization:
none
>Environment:
System: FreeBSD prawn.unsane.co.uk 7.0-STABLE FreeBSD 7.0-STABLE #52: Tue Mar 25 13:45:50 GMT 2008     toor@prawn.unsane.co.uk:/usr/local/obj/usr/src/sys/PRAWN7ULE  i386


>Description:
	removing a USB device that has an open session (for example tip) will 
panic the kernel, this is 100% reproducable for me.
{root@prawn}#more info.14
Dump header from device /dev/ad0s3b
  Architecture: i386
  Architecture Version: 2
  Dump Length: 154411008B (147 MB)
  Blocksize: 512
  Dumptime: Mon Mar 31 09:25:54 2008
  Hostname: prawn.unsane.co.uk
  Magic: FreeBSD Kernel Dump
  Version String: FreeBSD 7.0-STABLE #52: Tue Mar 25 13:45:50 GMT 2008
    toor@prawn.unsane.co.uk:/usr/local/obj/usr/src/sys/PRAWN7ULE
  Panic String: page fault
  Dump Parity: 1302845723
  Bounds: 14
  Dump Status: good

I'm happy to build a kernel with debug symbols if needed but it should be easy
to reproduce.

I have only tried this with a UFTDI device. I have a uark device at home I can
try it with if needed.

>How-To-Repeat:
	With the following entry in /etc/remote
usb0:dv=/dev/ttyU0:br#9600:pa=none:
tip usb0
then unplug the usb serial adapter.
>Fix:

unknown as yet


>Release-Note:
>Audit-Trail:

From: Vince Hoffman <jhary@unsane.co.uk>
To: bug-followup@FreeBSD.org, jhary@unsane.co.uk
Cc:  
Subject: Re: usb/122287: Removal of usb serial Device with session (eg tip)
 attached panics system
Date: Tue, 01 Apr 2008 10:30:56 +0100

 I have put an image of the console panic at
 http://unsane.co.uk/~jhary/freebsd/IMAGE_119.jpg

From: Vince Hoffman <jhary@unsane.co.uk>
To: bug-followup@FreeBSD.org, jhary@unsane.co.uk
Cc:  
Subject: Re: usb/122287: Removal of usb serial Device with session (eg tip)
 attached panics system
Date: Wed, 02 Apr 2008 10:49:49 +0100

 A Patch that fixes this was supplied by Kostik Belousov <kostikbel AT
 gmail DOt com>
 
 diff --git a/sys/kern/kern_conf.c b/sys/kern/kern_conf.c
 index 843498e..7e6e048 100644
 --- a/sys/kern/kern_conf.c
 +++ b/sys/kern/kern_conf.c
 @@ -402,8 +402,7 @@ giant_ioctl(struct cdev *dev, u_long cmd, caddr_t
 data, int fflag, struct thread
  	if (dsw == NULL)
  		return (ENXIO);
  	mtx_lock(&Giant);
 -	retval = dev->si_devsw->d_gianttrick->
 -	    d_ioctl(dev, cmd, data, fflag, td);
 +	retval = dsw->d_gianttrick->d_ioctl(dev, cmd, data, fflag, td);
  	mtx_unlock(&Giant);
  	dev_relthread(dev);
  	return (retval);
 @@ -419,8 +418,7 @@ giant_read(struct cdev *dev, struct uio *uio, int
 ioflag)
  	if (dsw == NULL)
  		return (ENXIO);
  	mtx_lock(&Giant);
 -	retval = dev->si_devsw->d_gianttrick->
 -	    d_read(dev, uio, ioflag);
 +	retval = dsw->d_gianttrick->d_read(dev, uio, ioflag);
  	mtx_unlock(&Giant);
  	dev_relthread(dev);
  	return (retval);
 
 
 Its a little spammy on the console but stops the panic
 
 Apr  2 10:36:30 prawn kernel: ucom0: <FTDI usb serial converter, class
 0/0, rev 1.10/4.00, addr 3> on uhub2
 Apr  2 10:36:33 prawn login: ROOT LOGIN (toor) ON ttyv0
 Apr  2 10:36:56 prawn kernel: ucom0: ucomreadcb: IOERROR
 Apr  2 10:36:56 prawn kernel: ucom0: at uhub2 port 1 (addr 3) disconnected
 Apr  2 10:36:57 prawn kernel: Still 4294967295 threads in ttyU0
 Apr  2 10:37:16 prawn last message repeated 188 times
 Apr  2 10:37:16 prawn login: ROOT LOGIN (toor) ON ttyv1
 Apr  2 10:37:16 prawn kernel: Still 4294967295 threads in ttyU0
 Apr  2 10:37:47 prawn last message repeated 303 times
 Apr  2 10:37:55 prawn last message repeated 85 times
Responsible-Changed-From-To: freebsd-usb->kib 
Responsible-Changed-By: kib 
Responsible-Changed-When: Wed Apr 2 10:00:04 UTC 2008 
Responsible-Changed-Why:  
Take. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=122287 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/122287: commit references a PR
Date: Wed,  2 Apr 2008 11:12:05 +0000 (UTC)

 kib         2008-04-02 11:11:58 UTC
 
   FreeBSD src repository
 
   Modified files:
     sys/kern             kern_conf.c 
   Log:
   Add two missed chunks from the rev. 1.210, for the giant_read() and
   giant_ioctl().
   
   PR:     kern/122287
   MFC after:      3 days
   
   Revision  Changes    Path
   1.211     +2 -4      src/sys/kern/kern_conf.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 

From: Vince Hoffman <jhary@unsane.co.uk>
To: bug-followup@FreeBSD.org, jhary@unsane.co.uk
Cc:  
Subject: Re: kern/122287: Removal of usb serial Device with session (eg tip)
 attached panics system
Date: Thu, 15 May 2008 20:06:01 +0100

 Just wanted to confirm this is fixed for me in 7-stable. feel free to 
 close the pr if developers are happy to.

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: kern/122287: commit references a PR
Date: Fri, 16 May 2008 11:41:57 +0000 (UTC)

 kib         2008-05-16 11:41:51 UTC
 
   FreeBSD src repository
 
   Modified files:        (Branch: RELENG_6)
     sys/kern             kern_conf.c 
   Log:
   MFC part of the rev. 1.210, and the rev. 1.211.
   
   In the giant_XXX wrappers for the device methods of the D_NEEDGIANT
   drivers, do not dereference the cdev->si_devsw. It is racing with
   the destroy_devl() clearing of the si_devsw. Instead, use the
   dev_refthread() and return ENXIO for the destroyed device.
   
   PR:     kern/122287
   
   Revision    Changes    Path
   1.186.2.10  +64 -20    src/sys/kern/kern_conf.c
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->closed 
State-Changed-By: kib 
State-Changed-When: Fri May 16 11:51:16 UTC 2008 
State-Changed-Why:  
The patch MFCed to RELENG_7 and RELENG_6. 

I cannot reproduce the reported issue with the "Still -1 threads in cuaU0". 
Feel free to open new PR if this is still an issue, and put me in Cc:. 

Thanks. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=122287 
>Unformatted:
