kern/138675: [panic] page fault, perhaps in USB

[Jonathan Hanna]

>Number:         138675
>Category:       kern
>Synopsis:       [panic] page fault, perhaps in USB
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Sep 09 18:50:05 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Jonathan Hanna
>Release:        FreeBSD 9.0-CURRENT i386
>Organization:
>Environment:

System: FreeBSD 9.0-CURRENT r196798 i386

>Description:

While mounting a CF card on a USB CF card reader:

panic: page fault

...
Unread portion of the kernel message buffer:
ugen1.2: <vendor 0x0424> at usbus1 (disconnected)
uhub2: at uhub1, port 4, addr 2 (disconnected)
ugen1.3: <vendor 0x0424> at usbus1 (disconnected)
(da0:umass-sim0:0:0:0): lost device
(da0:umass-sim0:0:0:0): removing device entry
(da1:umass-sim0:0:0:1): lost device
(da1:umass-sim0:0:0:1): removing device entry


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0xdeadc30d
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc07d7ff1
stack pointer           = 0x28:0xc62d5af4
frame pointer           = 0x28:0xc62d5b14
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 14 (usbus1)
trap number             = 12
panic: page fault
cpuid = 0

Loaded symbols for /boot/kernel/sound.ko
#0  doadump () at pcpu.h:246
246     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) #0  doadump () at pcpu.h:246
#1  0xc08a538f in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:416
#2  0xc08a5672 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:579
#3  0xc0c006d3 in trap_fatal (frame=0xc62d5ab4, eva=3735929613)
    at /usr/src/sys/i386/i386/trap.c:933
#4  0xc0c008b0 in trap_pfault (frame=0xc62d5ab4, usermode=0, eva=3735929613)
    at /usr/src/sys/i386/i386/trap.c:846
#5  0xc0c012e3 in trap (frame=0xc62d5ab4) at /usr/src/sys/i386/i386/trap.c:528
#6  0xc0be3aab in calltrap () at /usr/src/sys/i386/i386/exception.s:165
#7  0xc07d7ff1 in uhub_find_iface_index (hub=0xdeadc0de, child=0xc6ab2600, 
    res=0xc62d5b48) at /usr/src/sys/dev/usb/usb_hub.c:953
#8  0xc07d81bc in uhub_child_pnpinfo_string (parent=0xc6ae6080, 
    child=0xc6ab2600, buf=0xc71f0400 "", buflen=1024)
    at /usr/src/sys/dev/usb/usb_hub.c:1018
#9  0xc08cc5b6 in bus_child_pnpinfo_str (child=0xc6ab2600, buf=0xc71f0400 "", 
    buflen=1024) at bus_if.h:578
#10 0xc08ce487 in device_detach (dev=0xc6ab2600)
    at /usr/src/sys/kern/subr_bus.c:725
#11 0xc08ce625 in device_delete_child (dev=0xc6ae6080, child=0xc6ab2600)
    at /usr/src/sys/kern/subr_bus.c:1820
#12 0xc08ce60c in device_delete_child (dev=0xc6ae6980, child=0xc6ae6080)
    at /usr/src/sys/kern/subr_bus.c:1815
#13 0xc08ce60c in device_delete_child (dev=0xc69b6280, child=0xc6ae6980)
    at /usr/src/sys/kern/subr_bus.c:1815
#14 0xc07d138e in usb_unconfigure (udev=0xc6ab7000, flag=Variable "flag" is not available.
)
    at /usr/src/sys/dev/usb/usb_device.c:1022
#15 0xc07d16be in usb_free_device (udev=0xc6ab7000, flag=Variable "flag" is not available.
)
    at /usr/src/sys/dev/usb/usb_device.c:1985
#16 0xc07d90d7 in uhub_explore (udev=0xc6a74000)
    at /usr/src/sys/dev/usb/usb_hub.c:322
#17 0xc07c4feb in usb_bus_explore (pm=0xc6731d34)
    at /usr/src/sys/dev/usb/controller/usb_controller.c:239
#18 0xc07db7ce in usb_process (arg=0xc6731cd4)
    at /usr/src/sys/dev/usb/usb_process.c:164
#19 0xc087b0a8 in fork_exit (callout=0xc07db6f0 <usb_process>, 
    arg=0xc6731cd4, frame=0xc62d5d38) at /usr/src/sys/kern/kern_fork.c:843
#20 0xc0be3b50 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:270
(kgdb) 

>How-To-Repeat:
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted: