Bug 124980

Summary: [panic] kernel panic on detaching unmounted umass device
Product: Base System Reporter: Veniamin <g.veniamin>
Component: usbAssignee: freebsd-usb (Nobody) <usb>
Status: Open ---    
Severity: Affects Only Me CC: grahamperrin
Priority: Normal Keywords: crash
Version: 8.0-CURRENT   
Hardware: Any   
OS: Any   

Description Veniamin 2008-06-25 14:40:02 UTC
(kgdb) core-file vmcore.1

Unread portion of the kernel message buffer:
umass0: at uhub3 port 3 (addr 2) disconnected


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor write, page not present
instruction pointer     = 0x20:0xc044e89b
stack pointer           = 0x28:0xc4afa9b4
frame pointer           = 0x28:0xc4afa9d0
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 19 (usb3)
trap number             = 12
panic: page fault
Uptime: 5m1s
Physical memory: 2006 MB
Dumping 78 MB: 63 47 31 15

Loaded symbols for /boot/kernel/snd_ich.ko
Loaded symbols for /boot/kernel/sound.ko
Loaded symbols for /boot/kernel/umodem.ko
Loaded symbols for /boot/kernel/i915.ko
Loaded symbols for /boot/kernel/acpi.ko
#0  doadump () at pcpu.h:196
196     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb)

How-To-Repeat: In connection vinchestre through adapter ide to usb. 
hdd TOSHIBA MK6025GAS for notebook
Comment 1 Volker Werth freebsd_committer freebsd_triage 2008-06-26 22:32:03 UTC
On 12/23/-58 20:59, Veniamin wrote:
...

Veniamin,

please give us the backtrace (while in kgdb, 'bt' command and a 'list
0xc044e89b'). Also please tell us what you've done prior to getting this
panic (device insert, device removal, accessing the device etc.).

What kld's have been loaded?

Volker
Comment 2 Gavin Atkinson freebsd_committer freebsd_triage 2008-06-30 23:36:04 UTC
State Changed
From-To: open->feedback

Submitter was asked for feedback
Comment 3 Gavin Atkinson freebsd_committer freebsd_triage 2008-07-02 14:15:25 UTC
State Changed
From-To: feedback->open

Feedback received: 

ss# kldstat 
Id Refs Address Size Name 
1 35 0xc0400000 64c944 kernel (/boot/kernel/kernel) 
2 1 0xc0a4d000 7040 snd_ich.ko (/boot/kernel/snd_ich.ko) 
3 2 0xc0a55000 4a744 sound.ko (/boot/kernel/sound.ko) 
4 1 0xc0aa0000 3500 umodem.ko (/boot/kernel/umodem.ko) 
5 1 0xc0aa4000 7200 i915.ko (/boot/kernel/i915.ko) 
6 1 0xc0aac000 6b6a0 acpi.ko (/boot/kernel/acpi.ko) 

device insert 

umass0: <vendor 0x05e3 USB TO IDE, class 0/0, rev 2.00/0.33, addr 2> on 
uhub3 

device removal kernel panic 

(kgdb) core-file vmcore.0 

Unread portion of the kernel message buffer: 
umass0: BBB reset failed, IOERROR 
umass0: BBB bulk-in clear stall failed, IOERROR 
umass0: BBB bulk-out clear stall failed, IOERROR 
umass0: at uhub3 port 1 (addr 2) disconnected 


Fatal trap 12: page fault while in kernel mode 
fault virtual address = 0x0 
fault code = supervisor write, page not present 
instruction pointer = 0x20:0xc044e89b 
stack pointer = 0x28:0xc4afa9b4 
frame pointer = 0x28:0xc4afa9d0 
code segment = base rx0, limit 0xfffff, type 0x1b 
= DPL 0, pres 1, def32 1, gran 1 
processor eflags = interrupt enabled, resume, IOPL = 0 
current process = 19 (usb3) 
trap number = 12 
panic: page fault 
Uptime: 2m41s 
Physical memory: 2006 MB 
Dumping 76 MB: 61 45 29 13 

(kgdb) bt 0xc044e89b 
#0 doadump () at pcpu.h:196 
#1 0xc05d57f3 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418 
#2 0xc05d59ef in panic (fmt=Variable "fmt" is not available. 
) at /usr/src/sys/kern/kern_shutdown.c:572 
#3 0xc086e49c in trap_fatal (frame=0xc4afa974, eva=0) 
at /usr/src/sys/i386/i386/trap.c:934 
#4 0xc086e700 in trap_pfault (frame=0xc4afa974, usermode=0, eva=0) 
at /usr/src/sys/i386/i386/trap.c:847 
#5 0xc086f049 in trap (frame=0xc4afa974) at 
/usr/src/sys/i386/i386/trap.c:525 
#6 0xc085beeb in calltrap () at /usr/src/sys/i386/i386/exception.s:165 
#7 0xc044e89b in xpt_done (done_ccb=0xc4dbcc00) 
at /usr/src/sys/cam/cam_xpt.c:4835 
#8 0xc0454f6e in probedone (periph=0xc531e000, done_ccb=Variable "done_ccb" 
is not available. 
) 
at /usr/src/sys/cam/cam_xpt.c:6392 
#9 0xc0450a21 in camisr_runqueue (V_queue=Variable "V_queue" is not 
available. 
) at /usr/src/sys/cam/cam_xpt.c:7316 
#10 0xc045435f in xpt_bus_deregister (pathid=1) 
at /usr/src/sys/cam/cam_xpt.c:4421 
#11 0xc0551a70 in umass_cam_detach_sim (sc=0xc5211800) 
at /usr/src/sys/dev/usb/umass.c:2712 
#12 0xc0551b1d in umass_detach (self=0xc531cc80) 
at /usr/src/sys/dev/usb/umass.c:1560 
#13 0xc05f7b78 in device_detach (dev=0xc531cc80) at device_if.h:212 
#14 0xc0558d32 in usb_disconnect_port (up=0xc4d2e730, parent=0xc4d3ee00) 
at /usr/src/sys/dev/usb/usb_subr.c:1380 
---Type <return> to continue, or q <return> to quit--- 
#15 0xc054eaee in uhub_explore (dev=0xc4d5d100) 
at /usr/src/sys/dev/usb/uhub.c:462 
#16 0xc0556e75 in usb_discover (v=Variable "v" is not available. 
) at /usr/src/sys/dev/usb/usb.c:728 
#17 0xc0557d4a in usb_event_thread (arg=0xc4d5c600) 
at /usr/src/sys/dev/usb/usb.c:440 
#18 0xc05b5e20 in fork_exit (callout=0xc0557ca0 <usb_event_thread>, 
arg=0xc4d5c600, frame=0xc4afad38) at /usr/src/sys/kern/kern_fork.c:812 
#19 0xc085bf60 in fork_trampoline () at 
/usr/src/sys/i386/i386/exception.s:270
Comment 4 Veniamin 2008-07-02 20:04:09 UTC
ss# kldstat
Id Refs Address Size Name
 1 35 0xc0400000 64c944 kernel (/boot/kernel/kernel)
 2 1 0xc0a4d000 7040 snd_ich.ko (/boot/kernel/snd_ich.ko)
 3 2 0xc0a55000 4a744 sound.ko (/boot/kernel/sound.ko)
 4 1 0xc0aa0000 3500 umodem.ko (/boot/kernel/umodem.ko)
 5 1 0xc0aa4000 7200 i915.ko (/boot/kernel/i915.ko)
 6 1 0xc0aac000 6b6a0 acpi.ko (/boot/kernel/acpi.ko)

device insert

umass0: <vendor 0x05e3 USB TO IDE, class 0/0, rev 2.00/0.33, addr 2> on 
uhub3

device removal kernel panic

(kgdb) core-file vmcore.0

Unread portion of the kernel message buffer:
umass0: BBB reset failed, IOERROR
umass0: BBB bulk-in clear stall failed, IOERROR
umass0: BBB bulk-out clear stall failed, IOERROR
umass0: at uhub3 port 1 (addr 2) disconnected


Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x0
fault code = supervisor write, page not present
instruction pointer = 0x20:0xc044e89b
stack pointer = 0x28:0xc4afa9b4
frame pointer = 0x28:0xc4afa9d0
code segment = base rx0, limit 0xfffff, type 0x1b
  = DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 19 (usb3)
trap number = 12
panic: page fault
Uptime: 2m41s
Physical memory: 2006 MB
Dumping 76 MB: 61 45 29 13

(kgdb) bt 0xc044e89b
#0 doadump () at pcpu.h:196
#1 0xc05d57f3 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2 0xc05d59ef in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:572
#3 0xc086e49c in trap_fatal (frame=0xc4afa974, eva=0)
  at /usr/src/sys/i386/i386/trap.c:934
#4 0xc086e700 in trap_pfault (frame=0xc4afa974, usermode=0, eva=0)
  at /usr/src/sys/i386/i386/trap.c:847
#5 0xc086f049 in trap (frame=0xc4afa974) at 
/usr/src/sys/i386/i386/trap.c:525
#6 0xc085beeb in calltrap () at /usr/src/sys/i386/i386/exception.s:165
#7 0xc044e89b in xpt_done (done_ccb=0xc4dbcc00)
  at /usr/src/sys/cam/cam_xpt.c:4835
#8 0xc0454f6e in probedone (periph=0xc531e000, done_ccb=Variable 
"done_ccb" is not available.
)
  at /usr/src/sys/cam/cam_xpt.c:6392
#9 0xc0450a21 in camisr_runqueue (V_queue=Variable "V_queue" is not 
available.
) at /usr/src/sys/cam/cam_xpt.c:7316
#10 0xc045435f in xpt_bus_deregister (pathid=1)
  at /usr/src/sys/cam/cam_xpt.c:4421
#11 0xc0551a70 in umass_cam_detach_sim (sc=0xc5211800)
  at /usr/src/sys/dev/usb/umass.c:2712
#12 0xc0551b1d in umass_detach (self=0xc531cc80)
  at /usr/src/sys/dev/usb/umass.c:1560
#13 0xc05f7b78 in device_detach (dev=0xc531cc80) at device_if.h:212
#14 0xc0558d32 in usb_disconnect_port (up=0xc4d2e730, parent=0xc4d3ee00)
  at /usr/src/sys/dev/usb/usb_subr.c:1380
---Type <return> to continue, or q <return> to quit---
#15 0xc054eaee in uhub_explore (dev=0xc4d5d100)
  at /usr/src/sys/dev/usb/uhub.c:462
#16 0xc0556e75 in usb_discover (v=Variable "v" is not available.
) at /usr/src/sys/dev/usb/usb.c:728
#17 0xc0557d4a in usb_event_thread (arg=0xc4d5c600)
  at /usr/src/sys/dev/usb/usb.c:440
#18 0xc05b5e20 in fork_exit (callout=0xc0557ca0 <usb_event_thread>,
  arg=0xc4d5c600, frame=0xc4afad38) at /usr/src/sys/kern/kern_fork.c:812
#19 0xc085bf60 in fork_trampoline () at 
/usr/src/sys/i386/i386/exception.s:270
Comment 5 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:59:41 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 6 Graham Perrin freebsd_committer freebsd_triage 2021-10-31 08:49:46 UTC
Is this reproducible with FreeBSD 13.0-RELEASE?
Comment 7 Graham Perrin freebsd_committer freebsd_triage 2022-10-17 12:17:12 UTC
Keyword: 

    crash

– in lieu of summary line prefix: 

    [panic]

* bulk change for the keyword
* summary lines may be edited manually (not in bulk). 

Keyword descriptions and search interface: 

    <https://bugs.freebsd.org/bugzilla/describekeywords.cgi>