Bug 125510 - [panic] repeated plug and unplug of USB mass storage devices leads to stall, panics
Summary: [panic] repeated plug and unplug of USB mass storage devices leads to stall, ...
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: usb (show other bugs)
Version: 7.0-RELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-usb (Nobody)
Depends on:
Reported: 2008-07-11 16:10 UTC by S. Hutchins
Modified: 2018-01-03 05:16 UTC (History)
0 users

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description S. Hutchins 2008-07-11 16:10:03 UTC
Tested on at least two separate machines, a Shuttle with ICH6 and an
Intel Server with an ICH8.

Repeatedly plug and unplug a mass storage device. It doesn't seem to
matter what kind. The kernel will panic. There are multiple locations for
the panic, but I expect the system state that triggers the panic is
related: it's always a NULL dereference, and it's always the result of
plugging or unplugging the device, and the EIPs are relatively close.

I have two panics logged on the stock FreeBSD 7 kernel:

The first is a dereference off of NULL faulting address == 0:
EIP = 20:0xc04675b6
Supervisor write, page not present; trap 12 in proc 2 (g_event)

The second is a dereference 0x10 off of NULL, faulting address == 0x10:
EIP = 20:0xc04801e5
Supervisor write, page not present; trap 12 in proc 35 (usb2)

Likewise, if a mass storage device(s) is already plugged in and doing
I/O, and another device is plugged and unplugged repeatedly, the I/O
on the other device(s) will eventually stall, even if that original
device is connected through nested hubs. This can impact multiple devices
at once. The message is shown:

<dev>: BBB reset failed, IOERROR
<dev>: BBB bulk-in clear stall failed (TIMEOUT)
<dev>: BBB bulk-out clear stall failed (TIMEOUT)

The device is unresponsive until it is removed and reconnected.


Make sure NULL isn't dereferenced, to fix the first set of problems.
This may not be trivial. Apparently the USB driver is subtle and quick
to panic.
How-To-Repeat: To yield a panic, choose a mass storage device at random. Repeatedly
plug and unplug the device, especially prior to the system indicating
that the device has been detected.

To yield a stall, attach a mass storage device and start non-stop I/O
to it. You can also choose to select multiple mass storage devices and
have them all do I/O. Plug this device or hub into one port into the
EHCI host controller. Repeatedly plug and unplug another mass storage
device into an adjacent port. Other ports may work but I believe they
must be associated with the same host controller. Eventually I/O on one
or more of the connected devices will stall.
Comment 1 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:58:22 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped