kern/125985: umass - no da-device, panic upon unplugging

[Mikhail T.]

>Number:         125985
>Category:       kern
>Synopsis:       umass - no da-device, panic upon unplugging
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Jul 26 16:10:03 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Mikhail T.
>Release:        FreeBSD 7.0-STABLE amd64
>Organization:
Virtual Estates, Inc. ( http://libpipe.com/ )
>Environment:
System: FreeBSD aldan.algebra.com 7.0-STABLE FreeBSD 7.0-STABLE #0: Sat Jul 26 10:52:20 EDT 2008 root at aldan.algebra.com:/meow/objSILVER-SMP amd64


>Description:
	The device is identified upon being plugged in as:

	umass1: <iRiver iRiver iHP-100 Series, class 0/0, rev 2.00/1.00, addr 3> on uhub4

	For some reason, NO disk-device (da*) is created.

	Upon disconnecting, the panic hits -- 100% reproducible (four
	times out of four):

	Fatal trap 12: page fault while in kernel mode
	cpuid = 0; apic id = 00
	fault virtual address   = 0x0
	fault code              = supervisor write data, page not present
	instruction pointer     = 0x8:0xffffffff8015bde1
	stack pointer           = 0x10:0xffffffffadf5e800
	frame pointer           = 0x10:0xffffff000348e000
	code segment            = base 0x0, limit 0xfffff, type 0x1b
				= DPL 0, pres 1, long 1, def32 0, gran 1
	processor eflags        = interrupt enabled, resume, IOPL = 0
	current process         = 28 (usb1)
	trap number             = 12
	panic: page fault
	[...]

[...]
#7  0xffffffff8044946e in calltrap () at amd64/amd64/exception.S:169
#8  0xffffffff8015bde1 in xpt_done (done_ccb=0xffffff000348e000) at cam/cam_xpt.c:4856
#9  0xffffffff80161c0a in probedone (periph=0xffffff0003f36100, done_ccb=Variable "done_ccb" is not available.) at cam/cam_xpt.c:6331
#10 0xffffffff8015de93 in camisr_runqueue (V_queue=Variable "V_queue" is not available.) at cam/cam_xpt.c:7255
#11 0xffffffff80162985 in xpt_bus_deregister (pathid=Variable "pathid" is not available.) at cam/cam_xpt.c:4442
#12 0xffffffff8028f117 in umass_cam_detach_sim (sc=0xffffff000372a000) at dev/usb/umass.c:2708
#13 0xffffffff8028f1f7 in umass_detach (self=Variable "self" is not available.) at dev/usb/umass.c:1556
#14 0xffffffff80314b64 in device_detach (dev=0xffffff00246ee600) at device_if.h:212
#15 0xffffffff802933c5 in usb_disconnect_port (up=0xffffff00031c6138, parent=Variable "parent" is not available.) at dev/usb/usb_subr.c:1380
#16 0xffffffff8028df5d in uhub_explore (dev=0xffffff00031c6600) at dev/usb/uhub.c:462
#17 0xffffffff8029168b in usb_discover (v=Variable "v" is not available.) at dev/usb/usb.c:724
#18 0xffffffff8029263c in usb_event_thread (arg=Variable "arg" is not available.) at dev/usb/usb.c:440
#19 0xffffffff802cf072 in fork_exit (callout=0xffffffff802925c0 <usb_event_thread>, arg=0xffffff0001204800, frame=0xffffffffadf5ec80) at kern/kern_fork.c:781
#20 0xffffffff8044983e in fork_trampoline () at amd64/amd64/exception.S:415
	(kgdb) frame 8
	#8  0xffffffff8015bde1 in xpt_done (done_ccb=0xffffff000348e000) at cam/cam_xpt.c:4856
	4856                            TAILQ_INSERT_TAIL(&sim->sim_doneq, &done_ccb->ccb_h,
	(kgdb) p sim
	$1 = (struct cam_sim *) 0xffffffff806142c0
	(kgdb) p sim->sim_doneq
	$2 = {tqh_first = 0x0, tqh_last = 0x0}

I'll keep the vmcore and the kernel.debug around for a while -- let me
know, if you need more information.

>How-To-Repeat:

	See description.

>Fix:

	None known, hence high-priority -- the mp3-player is no longer
	usable (it worked with 6.x).
>Release-Note:
>Audit-Trail:
>Unformatted: