usb/128847: Detachment of mounted USB flash drive causes system freeze

[Patrick]

>Number:         128847
>Category:       usb
>Synopsis:       Detachment of mounted USB flash drive causes system freeze
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-usb
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Nov 13 18:10:06 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Patrick
>Release:        7.0
>Organization:
>Environment:
FreeBSD hostname 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008     root at logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
When I manually detach my USB flash drive that contains files in use on the system in question without umounting it, and then re-attach it, my system freezes.
>How-To-Repeat:
Mount the USB flash drive. Open one of the files located on the drive with a program such as Opera or leafpad (what I did). Manually remove the USB flash drive. Reinsert the flash drive.

I then tried to save the file I had opened in leafpad, and it told me it could not open the file for saving. I opened up a terminal and ran 'su', and that's when my system froze. /var/log/messages showed this:

Nov 13 17:16:10  kernel: GEOM_LABEL: Label msdosfs/WWMPCDD_USB removed.
Nov 13 17:45:23  kernel: umass0: at uhub4 port 5 (addr 2) disconnected
Nov 13 17:45:23  kernel: (da0:umass-sim0:0:0:0): lost device
Nov 13 17:45:23  kernel: umass0: detached
Nov 13 17:45:54  kernel: umass0: <SanDisk Corporation Cruzer Mini, class 0/0, rev 2.00/0.10, addr 2> on uhub4
Nov 13 17:45:54  root: Unknown USB device: vendor 0x0781 product 0x5150 bus uhub4
Nov 13 17:45:55  kernel: da1 at umass-sim0 bus 0 target 0 lun 0
Nov 13 17:45:55  kernel: da1: <SanDisk Cruzer Mini 0.1> Removable Direct Access SCSI-2 device 
Nov 13 17:45:55  kernel: da1: 40.000MB/s transfers
Nov 13 17:45:55  kernel: da1: 244MB (501759 512 byte sectors: 64H 32S/T 244C)
Nov 13 17:45:55  kernel: GEOM_LABEL: Label for provider da1s1 is msdosfs/WWMPCDD_USB.
Nov 13 17:45:58  kernel: g_vfs_done():da0s1[WRITE(offset=22452224, length=2048)]error = 6
>Fix:


Patch attached with submission follows:

Copyright (c) 1992-2008 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008
    root at logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Pentium(R) 4 CPU 2.40GHz (1202.73-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0xf29  Stepping = 9
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x4400<CNXT-ID,xTPR>
  Logical CPUs per core: 2
real memory  = 536805376 (511 MB)
avail memory = 503001088 (479 MB)
ACPI APIC Table: <IntelR AWRDACPI>
FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
 cpu0 (BSP): APIC ID:  0
 cpu1 (AP): APIC ID:  1
ioapic0: Changing APIC ID to 2
ioapic0 <Version 2.0> irqs 0-23 on motherboard
kbd1 at kbdmux0
ath_hal: 0.9.20.3 (AR5210, AR5211, AR5212, RF5111, RF5112, RF2413, RF5413)
hptrr: HPT RocketRAID controller driver v1.1 (Feb 24 2008 19:59:27)
acpi0: <IntelR AWRDACPI> on motherboard
acpi0: [ITHREAD]
acpi0: Power Button (fixed)
acpi0: reservation of 0, a0000 (3) failed
acpi0: reservation of 100000, 1fef0000 (3) failed
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
cpu0: <ACPI CPU> on acpi0
p4tcc0: <CPU Frequency Thermal Control> on cpu0
cpu1: <ACPI CPU> on acpi0
p4tcc1: <CPU Frequency Thermal Control> on cpu1
acpi_button0: <Power Button> on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
agp0: <Intel 82865 host to AGP bridge> on hostb0
pcib1: <PCI-PCI bridge> at device 1.0 on pci0
pci1: <PCI bus> on pcib1
nvidia0: <GeForce FX 5600> mem 0xf0000000-0xf0ffffff,0xe8000000-0xefffffff irq 16 at device 0.0 on pci1
nvidia0: [GIANT-LOCKED]
nvidia0: [ITHREAD]
uhci0: <Intel 82801EB (ICH5) USB controller USB-A> port 0xac00-0xac1f irq 16 at device 29.0 on pci0
uhci0: [GIANT-LOCKED]
uhci0: [ITHREAD]
usb0: <Intel 82801EB (ICH5) USB controller USB-A> on uhci0
usb0: USB revision 1.0
uhub0: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb0
uhub0: 2 ports with 2 removable, self powered
uhci1: <Intel 82801EB (ICH5) USB controller USB-B> port 0xa000-0xa01f irq 19 at device 29.1 on pci0
uhci1: [GIANT-LOCKED]
uhci1: [ITHREAD]
usb1: <Intel 82801EB (ICH5) USB controller USB-B> on uhci1
usb1: USB revision 1.0
uhub1: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb1
uhub1: 2 ports with 2 removable, self powered
uhci2: <Intel 82801EB (ICH5) USB controller USB-C> port 0xa400-0xa41f irq 18 at device 29.2 on pci0
uhci2: [GIANT-LOCKED]
uhci2: [ITHREAD]
usb2: <Intel 82801EB (ICH5) USB controller USB-C> on uhci2
usb2: USB revision 1.0
uhub2: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb2
uhub2: 2 ports with 2 removable, self powered
uhci3: <Intel 82801EB (ICH5) USB controller USB-D> port 0xa800-0xa81f irq 16 at device 29.3 on pci0
uhci3: [GIANT-LOCKED]
uhci3: [ITHREAD]
usb3: <Intel 82801EB (ICH5) USB controller USB-D> on uhci3
usb3: USB revision 1.0
uhub3: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb3
uhub3: 2 ports with 2 removable, self powered
ehci0: <Intel 82801EB/R (ICH5) USB 2.0 controller> mem 0xf4000000-0xf40003ff irq 23 at device 29.7 on pci0
ehci0: [GIANT-LOCKED]
ehci0: [ITHREAD]
usb4: EHCI version 1.0
usb4: companion controllers, 2 ports each: usb0 usb1 usb2 usb3
usb4: <Intel 82801EB/R (ICH5) USB 2.0 controller> on ehci0
usb4: USB revision 2.0
uhub4: <Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1> on usb4
uhub4: 8 ports with 8 removable, self powered
pcib2: <ACPI PCI-PCI bridge> at device 30.0 on pci0
pci2: <ACPI PCI bus> on pcib2
fwohci0: <Texas Instruments TSB43AB23> mem 0xf3005000-0xf30057ff,0xf3000000-0xf3003fff irq 17 at device 1.0 on pci2
fwohci0: [FILTER]
fwohci0: OHCI version 1.10 (ROM=1)
fwohci0: No. of Isochronous channels is 4.
fwohci0: EUI64 00:50:8d:00:00:f8:21:82
fwohci0: Phy 1394a available S400, 3 ports.
fwohci0: Link S400, max_rec 2048 bytes.
firewire0: <IEEE1394(FireWire) bus> on fwohci0
dcons_crom0: <dcons configuration ROM> on firewire0
dcons_crom0: bus_addr 0x1a68000
fwe0: <Ethernet over FireWire> on firewire0
if_fwe0: Fake Ethernet address: 02:50:8d:f8:21:82
fwe0: Ethernet address: 02:50:8d:f8:21:82
fwip0: <IP over FireWire> on firewire0
fwip0: Firewire address: 00:50:8d:00:00:f8:21:82 @ 0xfffe00000000, S400, maxrec 2048
sbp0: <SBP-2/SCSI over FireWire> on firewire0
fwohci0: Initiate bus reset
fwohci0: BUS reset
fwohci0: node_id=0xc800ffc0, gen=1, CYCLEMASTER mode
rl0: <RealTek 8139 10/100BaseTX> port 0x9000-0x90ff mem 0xf3004000-0xf30040ff irq 18 at device 2.0 on pci2
miibus0: <MII bus> on rl0
rlphy0: <RealTek internal media interface> PHY 0 on miibus0
rlphy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
rl0: Ethernet address: 00:50:8d:f9:21:82
rl0: [ITHREAD]
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
atapci0: <Intel ICH5 UDMA100 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xf000-0xf00f at device 31.1 on pci0
ata0: <ATA channel 0> on atapci0
ata0: [ITHREAD]
ata1: <ATA channel 1> on atapci0
ata1: [ITHREAD]
pci0: <serial bus, SMBus> at device 31.3 (no driver attached)
pci0: <multimedia, audio> at device 31.5 (no driver attached)
acpi_tz0: <Thermal Zone> on acpi0
acpi_tz0: _PSV value is absurd, ignored (-266.7C)
fdc0: <floppy drive controller> port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on acpi0
fdc0: [FILTER]
fd0: <1440-KB 3.5" drive> on fdc0 drive 0
sio0: <16550A-compatible COM port> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
sio0: type 16550A
sio0: [FILTER]
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
atkbd0: [ITHREAD]
psm0: <PS/2 Mouse> irq 12 on atkbdc0
psm0: [GIANT-LOCKED]
psm0: [ITHREAD]
psm0: model IntelliMouse, device ID 3
pmtimer0 on isa0
ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0
ppc0: Generic chipset (NIBBLE-only) in COMPATIBLE mode
ppbus0: <Parallel port bus> on ppc0
ppbus0: [ITHREAD]
plip0: <PLIP network interface> on ppbus0
lpt0: <Printer> on ppbus0
lpt0: Interrupt-driven port
ppi0: <Parallel I/O> on ppbus0
ppc0: [GIANT-LOCKED]
ppc0: [ITHREAD]
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
sio1: configured irq 3 not in bitmap of probed irqs 0
sio1: port may not be enabled
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Timecounters tick every 1.000 msec
hptrr: no controller detected.
firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
firewire0: bus manager 0 (me)
ad0: 286188MB <Maxtor 6B300R0 BAH41B70> at ata0-master UDMA100
acd0: CDRW <LG CD-RW CED-8120B/2.00> at ata0-slave PIO4
acpi_tz0: _PSV value is absurd, ignored (-266.7C)
acpi_tz0: _PSV value is absurd, ignored (-266.7C)
SMP: AP CPU #1 Launched!
Trying to mount root from ufs:/dev/ad0s3a
WARNING: / was not properly dismounted
WARNING: /tmp was not properly dismounted
WARNING: /usr was not properly dismounted
WARNING: /var was not properly dismounted
umass0: <SanDisk Corporation Cruzer Mini, class 0/0, rev 2.00/0.10, addr 2> on uhub4
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <SanDisk Cruzer Mini 0.1> Removable Direct Access SCSI-2 device 
da0: 40.000MB/s transfers
da0: 244MB (501759 512 byte sectors: 64H 32S/T 244C)
GEOM_LABEL: Label for provider da0s1 is msdosfs/WWMPCDD_USB.
GEOM_LABEL: Label msdosfs/WWMPCDD_USB removed.


>Release-Note:
>Audit-Trail:
>Unformatted: