kern/122483: [panic] [ulpt] Repeatable panic in 7.0-STABLE

[Eugene Grosbein]

>Number:         122483
>Category:       kern
>Synopsis:       [panic] [ulpt] Repeatable panic in 7.0-STABLE
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Apr 06 12:00:09 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Eugene Grosbein
>Release:        FreeBSD 7.0-STABLE i386
>Organization:
Svyaz-Service JSC
>Environment:
System: FreeBSD grosbein.pp.ru 7.0-STABLE FreeBSD 7.0-STABLE #1: Sun Apr 6 19:17:33 KRAST 2008 eu at grosbein.pp.ru:/usr/local/obj/usr/local/src/sys/DADV i386
	HP 1022 USB printer

>Description:
	While debugging printing problem with my new USB printer
	I've faced easily repeatable kernel panic.

>How-To-Repeat:

	1. Connect USB printer while kernel has ulpt driver or
	ulpt.ko is loaded. dmesg shows:

ulpt0: <vendor 0x03f0 HP LaserJet 1022, class 0/0, rev 2.00/1.00, addr 2> on uhub4
ulpt0: using bi-directional mode


	2. Run "cat > /dev/ulpt0" command. No need to type anything here.
	3. Switch printer's power off. The system panices immediately:

ulpt0: at uhub4 port 3 (addr 2) disconnected
ulpt0: detached
panic: Bad tailq NEXT(0xd9526850->tqh_last) != NULL
cpuid = 0
KDB: stack backtrace:
db_trace_self_wrapper(c07c0c01,e5aa4c40,c057afb9,c07ea242,0,...) at 0xc04636b1 = db_trace_self_wrapper+0x26
kdb_backtrace(c07ea242,0,c079bbcf,e5aa4c4c,0,...) at 0xc05a13ea = kdb_backtrace+0x29
panic(c079bbcf,d9526850,c07bf0c9,1a3,c551c000,...) at 0xc057afb9 = panic+0x10f
callout_reset(c551c194,64,c05a8265,c551c000) at 0xc058b0de = callout_reset+0x155
sleepq_set_timeout(c0847c68,64,c07b5fa1,0,0,...) at 0xc05a8e33 = sleepq_set_timeout+0xe8
_sleep(c0847c68,c0847bc8,24c,c07b5fa1,64,...) at 0xc0582d0a = _sleep+0x1fe
g_io_schedule_up(c551c000,0,c07b7705,5d,0,...) at 0xc053a15b = g_io_schedule_up+0x132
g_up_procbody(0,e5aa4d38,c07ba6e7,305,c555c2ac,...) at 0xc053a85b = g_up_procbody+0x8d
fork_exit(c053a7ce,0,e5aa4d38) at 0xc055e181 = fork_exit+0xb8
fork_trampoline() at 0xc07537b0 = fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe5aa4d70, ebp = 0 ---

	4. Then it writes crashdump but it's not very useful
	for unknown reason. Here is backtrace:

Script started on Sun Apr  6 19:36:46 2008
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".
There is no member named pathname.
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc057ad2e in boot (howto=260)
    at /usr/local/src/sys/kern/kern_shutdown.c:409
#2  0xc057afe8 in panic (fmt=Variable "fmt" is not available.
) at /usr/local/src/sys/kern/kern_shutdown.c:563
#3  0xc058b0de in callout_reset (c=0xc551c194, to_ticks=100, 
    ftn=0xc05a8265 <sleepq_timeout>, arg=0xc551c000)
    at /usr/local/src/sys/kern/kern_timeout.c:471
#4  0xc05a8e33 in sleepq_set_timeout (wchan=0xc0847c68, timo=100)
    at /usr/local/src/sys/kern/subr_sleepqueue.c:360
#5  0xc0582d0a in _sleep (ident=0xc0847c68, lock=Variable "lock" is not available.
)
    at /usr/local/src/sys/kern/kern_synch.c:203
#6  0xc053a15b in g_io_schedule_up (tp=0xc551c000)
    at /usr/local/src/sys/geom/geom_io.c:592
#7  0xc053a85b in g_up_procbody () at /usr/local/src/sys/geom/geom_kern.c:95
#8  0xc055e181 in fork_exit (callout=0xc053a7ce <g_up_procbody>, arg=0x0, 
    frame=0xe5aa4d38) at /usr/local/src/sys/kern/kern_fork.c:781
#9  0xc07537b0 in fork_trampoline ()
    at /usr/local/src/sys/i386/i386/exception.s:205
(kgdb) bt full
#0  doadump () at pcpu.h:195
No locals.
#1  0xc057ad2e in boot (howto=260)
    at /usr/local/src/sys/kern/kern_shutdown.c:409
	_giantcnt = Variable "_giantcnt" is not available.
(kgdb) quit

Script done on Sun Apr  6 19:37:24 2008

>Fix:

	Unknown.


>Release-Note:
>Audit-Trail:
>Unformatted: