7.0-BETA3 kernel panic when unplugging USB stick

Matthias Schmidt xhr at gmx.net
Mon Nov 26 02:27:35 PST 2007

Hi everybody,

I experienced a kernel panic with FreeBSD 7.0-BETA3 and an USB stick.
After plugging the stick into the machine I got the following

umass0: <vendor 0x0420 product 0x1307, class 0/0, rev 2.00/1.00, addr 3>
on uhub2

The stick wasn't correctly recognized and I couldn't use it.  Googling
for that vendor ID I found the following PR:


When I plugged out the stick, I got the below messages followed by a
kernel panic:

umass0: BBB reset failed, STALLED
umass0: BBB bulk-in clear stall failed, STALLED
umass0: BBB bulk-out clear stall failed, STALLED
umass0: BBB reset failed, STALLED
umass0: at uhub2 port 4 (addr 3) disconnected

Backtrace below.  You can find a copy of the dmesg, pciconf -l -v
output, kernel config and the corresponding crash dump under:


FreeBSD version is

FreeBSD node008.lab.ds 7.0-BETA3 FreeBSD 7.0-BETA3 #0: Sun Nov 25
14:11:30 CET 2007 root at node008.lab.ds:/usr/src/sys/i386/compile/ 
NODE008  i386

with a GENERIC kernel supplemented only with WITNESS and debug options.

GDB will not be able to debug user-mode threads:
/usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
welcome to change it and/or distribute copies of it under certain
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
umass0: BBB reset failed, STALLED
umass0: BBB bulk-in clear stall failed, STALLED
umass0: BBB bulk-out clear stall failed, STALLED
umass0: BBB reset failed, STALLED
umass0: at uhub2 port 4 (addr 3) disconnected

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x10
fault code		= supervisor read, page not present
instruction pointer	= 0x20:0xc07453e3
stack pointer	        = 0x28:0xd51dc960
frame pointer	        = 0x28:0xd51dc970
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
			processor eflags	= interrupt enabled,
			resume, IOPL = 0
			current process		= 30 (usb1)
exclusive sleep mutex Giant r = 0 (0xc0bba270) locked @
panic: from debugger
cpuid = 0
Uptime: 16h39m33s
Physical memory: 499 MB
Dumping 100 MB: 85 69 53 37 21 5

#0  doadump () at pcpu.h:195
	195		__asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc075137e in boot (howto=260) at ../../../kern/kern_shutdown.c:409
#2  0xc075163b in panic (fmt=Variable "fmt" is not available.
		) at ../../../kern/kern_shutdown.c:563
#3  0xc048cf07 in db_panic (addr=Could not find the frame base for
		) at ../../../ddb/db_command.c:433
#4  0xc048d8f5 in db_command_loop () at ../../../ddb/db_command.c:401
#5  0xc048f065 in db_trap (type=12, code=0) at
#6  0xc07783b6 in kdb_trap (type=12, code=0, tf=0xd51dc920) at
#7  0xc0a09d1f in trap_fatal (frame=0xd51dc920, eva=16) at
#8  0xc0a09f53 in trap_pfault (frame=0xd51dc920, usermode=0, eva=16) at
#9  0xc0a0a925 in trap (frame=0xd51dc920) at
#10 0xc09f04ab in calltrap () at ../../../i386/i386/exception.s:139
#11 0xc07453e3 in _mtx_assert (m=0x0, what=4, file=0xc0a59667
		"../../../cam/cam_xpt.c", line=4300)
    at ../../../kern/kern_mutex.c:622
#12 0xc046e064 in xpt_release_ccb (free_ccb=0xc2f16c00) at
#13 0xc046e5c0 in probedone (periph=0xc53ee380, done_ccb=0xc2f16c00) at
#14 0xc046ac7f in camisr_runqueue (V_queue=Variable "V_queue" is not
		) at ../../../cam/cam_xpt.c:7255
#15 0xc046f396 in xpt_bus_deregister (pathid=0) at
#16 0xc06c80f0 in umass_cam_detach_sim (sc=0xc43a7000) at
#17 0xc06c819d in umass_detach (self=0xc53ee000) at
#18 0xc0772f1c in device_detach (dev=0xc53ee000) at device_if.h:212
#19 0xc06ce882 in usb_disconnect_port (up=0xc2f5536c, parent=0xc2f55480)
at ../../../dev/usb/usb_subr.c:1380
#20 0xc06c5a6e in uhub_explore (dev=0xc2f55700) at
#21 0xc06c5a36 in uhub_explore (dev=0xc2f29100) at
#22 0xc06cc835 in usb_discover (v=Variable "v" is not available.
		) at ../../../dev/usb/usb.c:724
#23 0xc06cd207 in usb_event_thread (arg=0xc2f1ca00) at
#24 0xc0733538 in fork_exit (callout=0xc06cd170 <usb_event_thread>,
		arg=0xc2f1ca00, frame=0xd51dcd38)
    at ../../../kern/kern_fork.c:754
#25 0xc09f0520 in fork_trampoline () at
(kgdb) up 9
#9  0xc0a0a925 in trap (frame=0xd51dc920) at
463				(void) trap_pfault(frame, FALSE, eva);
(kgdb) l
459			KASSERT(cold || td->td_ucred != NULL,
460			    ("kernel trap doesn't have
461			switch (type) {
462			case T_PAGEFLT:
				    /* page fault */
463				(void)
				    trap_pfault(frame, FALSE, eva);
464				goto out;
466			case T_DNA:
467	#ifdef DEV_NPX

If you need further information, don't hesitate to contact me.  I can
even provide remote access to that box if its needed.



Dipl.-Inf. Matthias Schmidt <schmidtm at mathematik.uni-marburg.de>
Dept. of Mathematics and Computer Science, Distributed Systems Group
Philipps-University of Marburg, Hans-Meerwein-Strasse, 35032 Marburg
Tel: +49-6421-2821591, Fax: +49-6421-2821573, Office C4347

More information about the freebsd-current mailing list