usb/124758: rum panics SMP kernel

[Paul]

>Number:         124758
>Category:       usb
>Synopsis:       rum panics SMP kernel
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-usb
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jun 19 14:00:06 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Paul
>Release:        FreeBSD-CURRENT
>Organization:
>Environment:
FreeBSD dhcppc0 8.0-CURRENT FreeBSD 8.0-CURRENT #3: Tue Jun 17 18:41:01 CEST 2008     root at dhcppc0:/usr/local/obj/usr/local/src/sys/KERNEL  i386
>Description:
Kernel will panic with rum0 interface turned on when machine as client tries to associate with AP.

On UP and "SMP" (with hint.apic.0.disabled="1") kernels I can not reproduce crash.

Part of textdump:

Process 19 (usbtask-hc) thread 0xc3df8d20 (100031)
db:1:alllocks>  show lockedvnods
Locked vnodes
db:0:kdb.enter.panic>  show pcpu
cpuid        = 0
curthread    = 0xc3df8d20: pid 19 "usbtask-hc"
curpcb       = 0xc3ae3d90
fpcurthread  = none
idlethread   = 0xc3c9aaf0: pid 10 "idle: cpu0"
APIC ID      = 0
currentldt   = 0x50
spin locks held:
db:0:kdb.enter.panic>  bt
Tracing pid 19 tid 100031 td 0xc3df8d20
kdb_enter(c0705f14,c0705f14,c06fb83b,c3ae3c30,0,...) at kdb_enter+0x3a
panic(c06fb83b,c4415c00,c3d846bc,c400e080,c3ae3c5c,...) at panic+0x12c
ehci_free_sqtd_chain(c3b0bd80,c0704a1f,c3d84000,c4415c00,c400e080,...) at ehci_free_sqtd_chain+0x54
ehci_device_bulk_done(c4415c00,100000,0,90000,f,...) at ehci_device_bulk_done+0xb5
usb_transfer_complete(c4415c00,c4415d7c,0,0,0,...) at usb_transfer_complete+0x1a9
ehci_abort_xfer(c3ae3cf8,c04a6e0a,c4415c00,0,5c,...) at ehci_abort_xfer+0x27b
ehci_timeout_task(c4415c00,0,5c,c06fd2a6,0,...) at ehci_timeout_task+0x10
usb_task_thread(c077c400,c3ae3d38,c0702339,324,c3c9929c,...) at usb_task_thread+0xca
fork_exit(c04a6d40,c077c400,c3ae3d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xc3ae3d70, ebp = 0 ---

Contact me for more info.
>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: