usb/117313: panic on usb camera attachment

[moose at opera.com]

>Number:         117313
>Category:       usb
>Synopsis:       panic on usb camera attachment
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-usb
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Oct 18 21:30:01 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator:     moose at opera.com
>Release:        FreeBSD 7.0-PRERELEASE
>Organization:
Opera Software
>Environment:
FreeBSD 7.0-PRERELEASE #2: Thu Oct 18 22:16:05 CEST 2007     moose at evangelista:/usr/obj/usr/src/sys/EVANGELISTA  amd64
>Description:
I get an always-reproducible panic when the digital camera is attached via USB, and activated.

On RELENG_6: 

umass0: KONICA MINOLTA DIMAGE CAMERA, rev 2.00/0.01, addr 2
umass0: Get Max Lun not supported (SHORT_XFER)
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <KMCA DIMAGE CAMERA 1.00> Removable Direct Access SCSI-0 device
da0: 40.000MB/s transfers
da0: 488MB (1000944 512 byte sectors: 64H 32S/T 488C)

On RELENG_7, the panic occurs immediately after the first two lines above.

-------------------------
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0x20
fault code = supervisor read data, page not present
instruction pointer = 0x8:0xffffffff802b6250
stack pointer = 0x10:0xffffffffabda5770
frame pointer = 0x10:0xffffffffabda5780
code segment = base 0x0, limit 0xfffff, type 0x1b
                = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 30 (usb1)
[ thread pid 30 tid 1000022 ]
Stopped at _mtx_assert+0x70: morq 0x20(%rdi),%rax

backtrace:
--------------------------------
Tracing pid 30 tid 1000022 td 0xffffff00182350
_mtx_assert() at _mtx_assert+0x70
xpt_release_ccb() at xpt_release_ccb+0x49
probedone() at probedone+0x9c
camisr_runqueue() at camisr_runqueue+0x1a3
xpt_bus_deregister() at xpt_bus_deregister+0x185
umass_cam_detach_sim() at umass_cam_detach_sim+0x1f
umass_detach() at umass_detach+0xcf
device_detach() at device_detach+0xa4
usb_disconnect_port() at usb_disconnect_port+0x86
uhub_explore)_ at uhub_explore+0x101
usb_discover() at usb_discover+0x38
usb_event_thread() at usb_event_thread+0x7c
fork_exit)_ at fork_exit+0x128
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip=0, rsp=0xffffffffabda5d30, rbp=0 ---

>How-To-Repeat:
-- attach the camera to the machine via USB
-- turn the camera on --> panic
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: