i386/65783: Panic when attaching card reader to USB port

[Martin]

>Number:         65783
>Category:       i386
>Synopsis:       Panic when attaching card reader to USB port
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-i386
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Apr 19 13:00:41 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Martin
>Release:        FreeBSD-CURRENT
>Organization:
>Environment:
FreeBSD xxx.local 5.2-CURRENT FreeBSD 5.2-CURRENT #0: Mon Apr 19 21:20:35 CEST 2004 i386

>Description:
When attaching the USB card reader/writer "hama - USB 2.0 Card Reader 9in1", I get panic instantly after the kernel recognizes the new device (it happens in two scenarios: on boot with attached device and while attaching to a running system).

Last output I can see before panic() occurs is (Thinkpad R40):
umass0: SCSI over Bulk-Only: quirks = 0x0000
umass0:3:0:-1: Attached to scbus3
da0: at umass-sim0 bus 0 target 0 lun 0
da0: <ICSI CF CARD       CF 1.3A> Removable Direct Access SCSI-0 device
da0: 1.000MB/s transfers
da0: 122MB (250368 512 byte sectors: 64H 32S/T 122C)
da1: <ICSI MS Card       MS 1.3A> Removable Direct Access SCSI-0 device
da1: 1.000MB/s transfers
da1: Attempt to query device size failed: NOT READY, Medium not present
(da2:umass-sim0:0:0:2): READ CAPACITY. CDB: 25 40 0 0 0 0 0 0 0 0
(da2:umass-sim0:0:0:2): ILLEGAL REQUEST asc:25,0
(da2:umass-sim0:0:0:2): Logical unit not supported
(da2:umass-sim0:0:0:2): fatal error, failed to attach device
(da2:umass-sim0:0:0:2): lost device
(da2:umass-sim0:0:0:2): removing device entry
(da2:umass-sim0:0:0:3): READ CAPACITY. CDB: 25 60 0 0 0 0 0 0 0 0
(da2:umass-sim0:0:0:3): ILLEGAL REQUEST asc:25,0
(da2:umass-sim0:0:0:3): Logical unit not supported
(da2:umass-sim0:0:0:3): fatal error, failed to attach device
(da2:umass-sim0:0:0:3): lost device
(da2:umass-sim0:0:0:3): removing device entry


Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x3c
fault code		= supervisor write, page not present
instruction pointer	= 0x8:0xc0540cc9
stack pointer		= 0x10:0xcdcd3ce4
frame pointer		= 0x10:0xcdcd3ce8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 2 (g_event)
kernel: type 12 trap, code=0
Stopped at	g_disk_destroy+0x9: movl	$0,0x3c(%eax)
db> trace
g_disk_destroy(c2ddea80,0) at g_disk_destroy+0x9
one_event(cdcd3d20,c05424d1,258,190,c2af0898) at one_event+0x18f
g_run_events(258,190,c2af0898,c05424b0,cdcd3d34) at g_run_events+0x9
g_event_procbody(0,cdcd3d48) at g_event_procbody+0x21
fork_exit(c05424b0,0,cdcd3d48) at fork_exit+0x71
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xcdcd3d7c, ebp = 0 ---


I can also reproduce it on a second machine running current (P3-500). Both are running CURRENT with uhci (Intel chipset).

>How-To-Repeat:

- compile kernel with option USB_DEBUG (or else it will crash a bit later at various positions; non-deterministic)
- plug in the card reader

or

- boot FreeBSD with the card reader already plugged in

>Fix:
      
>Release-Note:
>Audit-Trail:
>Unformatted: