kern/71491: printing under usb printer causes a kernel panic

[Amir Shalem]

>Number:         71491
>Category:       kern
>Synopsis:       printing under usb printer causes a kernel panic
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 08 11:50:23 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     Amir Shalem
>Release:        FreeBSD 5.3-BETA3 i386
>Organization:
>Environment:
System: FreeBSD vmware.active.ath.cx 5.3-BETA3 FreeBSD 5.3-BETA3 #2: Wed Sep 8 13:37:55 IDT 2004 root at vmware.active.ath.cx:/usr/src/sys/i386/compile/VMWARE i386

	I have set test machine, under vmware, where I installed 5.3-beta3
	The printer is HP DeskJet 3650
	I use it under cups + hpijs-cups (not in ports)

>Description:
	This bug also happens with 6-current.

	I have tried this under with:
		offical 5.3-beta3 kernel
		5.3-beta3 + ule  + usb_debug (at level 10)
		5.3-beta3 + 4bsd + usb_debug (at level 10)
	in all conditions I got the crash,
	where using the usb_debug I got it _right away_
	where as, in the offical I had to do multiply printing in cups.

	The problem is printing via cups, printing test page for example,
	causes the bug.

	if I turn DIAGNOSTIC on the bug does appear.

	I have kernel dump + kernel.debug for all kind of kernels (at request),
	here goes the dmesg and backtrace of 4bsd+usbdebug:

TD(0xc12e3f60) at 04c77f60 = link=0x04c77f84 status=0x388003ff token=0x07e90269
  4c77f84<VF> 388003ff<ACTIVE,SPD>,errcnt=3,actlen=0 pid=69,addr=2,endpt=2,D=1,m
TD(0xc12e3f80) at 04c77f80 = link=0x00000005 status=0x398003ff token=0x07e10269
  5<T,VF> 398003ff<ACTIVE,IOC,SPD>,errcnt=3,actlen=0 pid=69,addr=2,endpt=2,D=0,m
uhci_start_loop: add
ulpt_tick: err=1
uhci_timeout: uxfer=0xc16a8a00
usb_add_task: task=0xc16a8a84
usb_transfer_complete: pipe=0xc16a6a00 xfer=0xc16a8a00 status=0 actlen=0
usb_transfer_complete: repeat=0 new head=0
ulpt_read_cb: start sc=0xc13ae880, err=0 n=0
uhci_device_bulk_done: xfer=0xc16a8a00 ii=0xc16a8a6c sc=0xc12e1000 upipe=0xc16a6
uhci_end_loop: remove
uhci_device_bulk_done: length=0
usbd_start_next: pipe=0xc16a6a00, xfer=0
usb_task_thread: woke up task=0xc16a8a84
uhci_timeout_task: xfer=0xc16a8a00
uhci_abort_xfer: xfer=0xc16a8a00, status=15
uhci_abort_xfer: stop ii=0xc16a8a6c
uhci_abort_xfer: callback
usb_transfer_complete: pipe=0xc16a6a00 xfer=0xc16a8a00 status=15 actlen=0

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x4c
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc05b398d
stack pointer           = 0x10:0xc636ccbc
frame pointer           = 0x10:0xc636ccd8
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 46 (usbtask)
panic: from debugger

	and backtrace:
#25 0xc05b398d in usb_transfer_complete (xfer=0xc16a8a00)
    at ../../../dev/usb/usbdi.c:819
#26 0xc05a390a in uhci_abort_xfer (xfer=0xc16a8a00, status=USBD_TIMEOUT)
    at ../../../dev/usb/uhci.c:1994
#27 0xc05a2f08 in uhci_timeout_task (addr=0xc16a8a00)
    at ../../../dev/usb/uhci.c:1533
#28 0xc05afd45 in usb_task_thread (arg=0x0) at ../../../dev/usb/usb.c:464
#29 0xc05f29dc in fork_exit (callout=0xc05afc98 <usb_task_thread>, arg=0x0,
    frame=0xc636cd48) at ../../../kern/kern_fork.c:820
#30 0xc077ae6c in fork_trampoline () at ../../../i386/i386/exception.s:209
(kgdb) frame 25
#25 0xc05b398d in usb_transfer_complete (xfer=0xc16a8a00)
    at ../../../dev/usb/usbdi.c:819
819                     SIMPLEQ_REMOVE_HEAD(&pipe->queue, next);
(kgdb) print pipe->queue
$1 = {stqh_first = 0x0, stqh_last = 0xc16a6a14}
(kgdb) print *pipe->queue->stqh_last
$2 = (struct usbd_xfer *) 0x0
(kgdb) q


	Basicly the pipe queue is empty when reaching the code,
	and it expects to have something in queue.

>How-To-Repeat:
	Boot kernel with USB_DEBUG, and set:
		hw.usb.debug=10
		hw.usb.ulpt.debug=10
		hw.usb.uhci.debug=10
	and try to print to your usb printer.

>Fix:
	Unknown.
	Maybe to add a check to see if queue is already empty ?

>Release-Note:
>Audit-Trail:
>Unformatted: