usb/139990: Kernel frequently panics after printing

[Alban Hertroys]

>Number:         139990
>Category:       usb
>Synopsis:       Kernel frequently panics after printing
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-usb
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Oct 26 16:00:06 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Alban Hertroys
>Release:        FreeBSD 7.2-STABLE i386
>Organization:
>Environment:
System: FreeBSD solfertje.student.utwente.nl 7.2-STABLE FreeBSD 7.2-STABLE #2: Tue Sep 15 11:34:08 CEST 2009 dalroi at solfertje.student.utwente.nl:/usr/obj/usr/src/sys/ERGOPROXY i386


	
>Description:
The kernel frequently panics after finishing printing a document. Previously a
patch was applied that changed the way the printer was detached after printing.

The full core.txt is available from
http://solfertje.student.utwente.nl/~dalroi/core.txt

It looks like a NULL-pointer gets passed, see step 7 in the backtrace:

solfertje.student.utwente.nl dumped core - see /usr/crash/vmcore.1

Mon Oct 26 14:19:45 CET 2009

FreeBSD solfertje.student.utwente.nl 7.2-STABLE FreeBSD 7.2-STABLE #2: Tue Sep 15 11:34:08 CEST 2009     dalroi at solfertje.student.utwente.nl:/usr/obj/usr/src/sys/ERGOPROXY  i386

panic: page fault

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 01
fault virtual address	= 0x0
fault code		= supervisor write, page not present
instruction pointer	= 0x20:0xc0525a49
stack pointer	        = 0x28:0xc43aac4c
frame pointer	        = 0x28:0xc43aac4c
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 12 (swi4: clock)
trap number		= 12
panic: page fault
cpuid = 0
Uptime: 38d0h43m38s
Physical memory: 1526 MB
Dumping 264 MB: 249 233 217 201 185 169 153 137 121 105 89 73 57 41 25 9

Reading symbols from /boot/kernel/geom_concat.ko...Reading symbols from /boot/kernel/geom_concat.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/geom_concat.ko
Reading symbols from /boot/kernel/geom_mirror.ko...Reading symbols from /boot/kernel/geom_mirror.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/geom_mirror.ko
Reading symbols from /boot/kernel/geom_stripe.ko...Reading symbols from /boot/kernel/geom_stripe.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/geom_stripe.ko
Reading symbols from /boot/kernel/acpi.ko...Reading symbols from /boot/kernel/acpi.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/acpi.ko
Reading symbols from /boot/kernel/pf.ko...Reading symbols from /boot/kernel/pf.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/pf.ko
Reading symbols from /boot/kernel/linux.ko...Reading symbols from /boot/kernel/linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
#0  doadump () at pcpu.h:196
196	pcpu.h: No such file or directory.
	in pcpu.h
(kgdb) #0  doadump () at pcpu.h:196
#1  0xc05a3547 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2  0xc05a381c in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:574
#3  0xc0800eac in trap_fatal (frame=0xc43aac0c, eva=0)
    at /usr/src/sys/i386/i386/trap.c:943
#4  0xc0801130 in trap_pfault (frame=0xc43aac0c, usermode=0, eva=0)
    at /usr/src/sys/i386/i386/trap.c:856
#5  0xc0801b37 in trap (frame=0xc43aac0c) at /usr/src/sys/i386/i386/trap.c:534
#6  0xc07e66cb in calltrap () at /usr/src/sys/i386/i386/exception.s:166
#7  0xc0525a49 in usbd_setup_xfer (xfer=0x0, pipe=0x0, priv=0xc6d7c480, 
    buffer=0xc67b7000, length=4096, flags=5, timeout=10, 
    callback=0xc051cd90 <ulpt_read_cb>) at /usr/src/sys/dev/usb/usbdi.c:547
#8  0xc051cd71 in ulpt_tick (xsc=0xc6d7c480)
    at /usr/src/sys/dev/usb/ulpt.c:773
#9  0xc05b5e4c in softclock (dummy=0x0)
    at /usr/src/sys/kern/kern_timeout.c:274
#10 0xc058012b in ithread_loop (arg=0xc44902f0)
    at /usr/src/sys/kern/kern_intr.c:1126
#11 0xc057ca57 in fork_exit (callout=0xc057ff80 <ithread_loop>, 
    arg=0xc44902f0, frame=0xc43aad38) at /usr/src/sys/kern/kern_fork.c:811
#12 0xc07e6740 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:271
(kgdb) 
------------------------------------------------------------------------
dmesg

ulpt0: <Samsung Electronics Co., Ltd. Samsung Laser Printer ML-1200 Series, class 0/0, rev 1.10/1.00, addr 2> on uhub0
ulpt0: using bi-directional mode


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 01
fault virtual address	= 0x0
fault code		= supervisor write, page not present
instruction pointer	= 0x20:0xc0525a49
stack pointer	        = 0x28:0xc43aac4c
frame pointer	        = 0x28:0xc43aac4c
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 12 (swi4: clock)
trap number		= 12
panic: page fault
cpuid = 0
Uptime: 38d0h43m38s
Physical memory: 1526 MB
Dumping 264 MB: 249 233 217 201 185 169 153 137 121 105 89 73 57 41 25 9

>How-To-Repeat:
	Repeatedly print a document to an USB printer. It seems to happen every
	other time here.
>Fix:
	None yet.

>Release-Note:
>Audit-Trail:
>Unformatted: