From paul@snark.rtelekom.ru  Mon Jun  3 01:11:23 2002
Return-Path: <paul@snark.rtelekom.ru>
Received: from snark.rtelekom.ru (snark.rtelekom.ru [217.146.42.132])
	by hub.freebsd.org (Postfix) with ESMTP id 2C0CC37B403
	for <FreeBSD-gnats-submit@freebsd.org>; Mon,  3 Jun 2002 01:11:22 -0700 (PDT)
Received: from snark.rtelekom.ru (paul@localhost [127.0.0.1])
	by snark.rtelekom.ru (8.12.3/8.12.2) with ESMTP id g538BGAj030347
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 3 Jun 2002 12:11:16 +0400 (MSD)
	(envelope-from paul@snark.rtelekom.ru)
Received: (from paul@localhost)
	by snark.rtelekom.ru (8.12.3/8.12.3/Submit) id g538BEGr030346;
	Mon, 3 Jun 2002 12:11:14 +0400 (MSD)
Message-Id: <200206030811.g538BEGr030346@snark.rtelekom.ru>
Date: Mon, 3 Jun 2002 12:11:14 +0400 (MSD)
From: Paul Argentoff <argentoff@rtelekom.ru>
Reply-To: Paul Argentoff <argentoff@rtelekom.ru>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: kernel panic when removing memory stick from MSAC-US1 device
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         38848
>Category:       kern
>Synopsis:       kernel panic when removing memory stick from MSAC-US1 device
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    joe
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jun 03 01:20:01 PDT 2002
>Closed-Date:    Sat Nov 08 04:08:27 PST 2003
>Last-Modified:  Sat Nov 08 04:08:27 PST 2003
>Originator:     Paul Argentoff <argentoff@rtelekom.ru>
>Release:        FreeBSD 4.5-RELEASE i386
>Organization:
Ratmir-TeleKom, Tver, Russian Federation
>Environment:
System: FreeBSD a15.ratmir.tver.ru 4.5-RELEASE FreeBSD 4.5-RELEASE #1: Wed May 29 18:18:51 MSD 2002     root@a15.ratmir.tver.ru:/usr/src/sys/compile/A15-KRON  i386


>Description:
Sometimes (very often) when I remove a memory stick from MSAC-US1 (USB memory
stick reader from SONY), I get the following panic (here's the typescript of a
gdb session):

--- gdb-session begins here ---
Script started on Wed May 29 18:53:43 2002
[root@a15 crash]# gdb -k kernel.debug vmcore.6 
GNU gdb 4.18
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...
IdlePTD at phsyical address 0x00301000
initial pcb at physical address 0x00266040
panicstr: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x4
fault code		= supervisor read, page not present
instruction pointer	= 0x8:0xc01bd58e
stack pointer	        = 0x10:0xc0243e68
frame pointer	        = 0x10:0xc0243e70
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
interrupt mask		= bio 
trap number		= 12
panic: page fault

syncing disks... 

Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x30
fault code		= supervisor read, page not present
instruction pointer	= 0x8:0xc019c598
stack pointer	        = 0x10:0xc0243c8c
frame pointer	        = 0x10:0xc0243c94
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
interrupt mask		= bio 
trap number		= 12
panic: page fault
Uptime: 1m23s

dumping to dev #ad/0x30004, offset 892952
dump ata0: resetting devices .. done
63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 
---
#0  dumpsys () at ../../kern/kern_shutdown.c:474
474		if (dumping++) {
(kgdb) where
#0  dumpsys () at ../../kern/kern_shutdown.c:474
#1  0xc0140458 in boot (howto=260) at ../../kern/kern_shutdown.c:313
#2  0xc014085d in panic (fmt=0xc023b80c "%s") at ../../kern/kern_shutdown.c:582
#3  0xc01fdf08 in trap_fatal (frame=0xc0243c4c, eva=48) at ../../i386/i386/trap.c:956
#4  0xc01fdb9d in trap_pfault (frame=0xc0243c4c, usermode=0, eva=48) at ../../i386/i386/trap.c:849
#5  0xc01fd72f in trap (frame={tf_fs = -1072300016, tf_es = 6815760, tf_ds = -1071382512, tf_edi = 0, 
      tf_esi = -1064190976, tf_ebp = -1071367020, tf_isp = -1071367048, tf_ebx = -1071303940, 
      tf_edx = 6832224, tf_ecx = -971604736, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1072052840, 
      tf_cs = 8, tf_eflags = 66054, tf_esp = -1064190976, tf_ss = -1064190976})
    at ../../i386/i386/trap.c:448
#6  0xc019c598 in acquire_lock (lk=0xc02532fc) at ../../ufs/ffs/ffs_softdep.c:271
#7  0xc01a070c in softdep_update_inodeblock (ip=0xc091bc00, bp=0xc1d25874, waitfor=0)
    at ../../ufs/ffs/ffs_softdep.c:3775
#8  0xc019b6a6 in ffs_update (vp=0xc6167d00, waitfor=0) at ../../ufs/ffs/ffs_inode.c:106
#9  0xc01a3c4a in ffs_sync (mp=0xc08eea00, waitfor=2, cred=0xc05ab400, p=0xc0279500)
    at ../../ufs/ffs/ffs_vfsops.c:1014
#10 0xc0170e07 in sync (p=0xc0279500, uap=0x0) at ../../kern/vfs_syscalls.c:547
#11 0xc014022b in boot (howto=256) at ../../kern/kern_shutdown.c:234
#12 0xc014085d in panic (fmt=0xc023b80c "%s") at ../../kern/kern_shutdown.c:582
#13 0xc01fdf08 in trap_fatal (frame=0xc0243e28, eva=4) at ../../i386/i386/trap.c:956
#14 0xc01fdb9d in trap_pfault (frame=0xc0243e28, usermode=0, eva=4) at ../../i386/i386/trap.c:849
#15 0xc01fd72f in trap (frame={tf_fs = -1071382512, tf_es = -1071972336, tf_ds = -1063387120, tf_edi = 1, 
      tf_esi = -1064330496, tf_ebp = -1071366544, tf_isp = -1071366572, tf_ebx = -1064579264, tf_edx = 64, 
      tf_ecx = 0, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1071917682, tf_cs = 8, 
      tf_eflags = 66055, tf_esp = -1064330496, tf_ss = -1064611840}) at ../../i386/i386/trap.c:448
#16 0xc01bd58e in uhci_check_intr (sc=0xc08b5000, ii=0xc08f9b00) at ../../dev/usb/uhci.c:1029
#17 0xc01bd517 in uhci_intr (arg=0xc08b5000) at ../../dev/usb/uhci.c:990
(kgdb) up 16
#16 0xc01bd58e in uhci_check_intr (sc=0xc08b5000, ii=0xc08f9b00) at ../../dev/usb/uhci.c:1029
1029			for (std = ii->stdstart; std != lstd; std = std->link.std) {
(kgdb) up 1
#17 0xc01bd517 in uhci_intr (arg=0xc08b5000) at ../../dev/usb/uhci.c:990
990			uhci_check_intr(sc, ii);
(kgdb) q
[root@a15 crash]# exit

Script done on Wed May 29 18:54:24 2002
--- gdb-session ends here ---


>How-To-Repeat:
For example, (though it's not the only situation when the problem arises) one
can reproduce the panic removing a memory stick shortly after it's been inserted
into the reader (while usbd is still registering the device in the system).

>Fix:
No idea.

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: kris 
State-Changed-When: Mon Jul 14 02:49:46 PDT 2003 
State-Changed-Why:  
Does this problem persist in recent releases? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=38848 
Responsible-Changed-From-To: freebsd-bugs->joe 
Responsible-Changed-By: kris 
Responsible-Changed-When: Thu Jul 17 17:41:28 PDT 2003 
Responsible-Changed-Why:  
Assign to USB maintainer 

http://www.freebsd.org/cgi/query-pr.cgi?pr=38848 
State-Changed-From-To: feedback->closed 
State-Changed-By: joe 
State-Changed-When: Sat Nov 8 04:06:33 PST 2003 
State-Changed-Why:  
Feedback on this problem was requested in July, but hasn't been 
received.  Please reopen a new problem report if the problem 
still exists. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=38848 
>Unformatted:
