Bug 126396 - [panic] kernel panic after unplug USB Bluetooth device [regression]
Summary: [panic] kernel panic after unplug USB Bluetooth device [regression]
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: Normal Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2008-08-09 16:20 UTC by admin
Modified: 2022-10-17 12:17 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description admin 2008-08-09 16:20:02 UTC
today, I update source and rebuild kernel and world
and see new behavior - 
kernel panic after unplug USB Bluetooth device
previous, I have source ~20 days oldest - and unplug not cause panic
===========
ubt0: at uhub0 port 1 (addr 3) desconnected
ubt0: detached

after 3-4 seconds - kernel panic:

Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x468
fault code = supervisor read data, page not present
instruction pointer = 0x8: 0xffffffff802ebt0e
stack pointer = 0x10: 0xfffffffe40091at0
frame pointer = 0x10: 0xfffffffe40091b30
code segment = base rx0, limit 0xfffff, type 0x1b
              = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 11 (irq19: ohci0 ohci+)
trap number = 12
panic: page fault

=======
kernel config
acer$ cat /usr/src/sys/amd64/conf/main-color-console | grep -v ^# | grep -v ^\$
include         GENERIC
options         SC_NORM_ATTR=(FG_GREEN|BG_BLACK)
options         SC_KERNEL_CONS_ATTR=(FG_RED|BG_BLACK)
options         SC_HISTORY_SIZE=2022
nooptions         KDB                     # Enable kernel debugger support.
nooptions         DDB                     # Support DDB.
nooptions         GDB                     # Support remote GDB.
nooptions         INVARIANTS              # Enable calls of extra sanity checking
nooptions         INVARIANT_SUPPORT       # Extra sanity checks of internal structures, required by INVARIANTS
nooptions         WITNESS                 # Enable checks to detect deadlocks and cycles
nooptions         WITNESS_SKIPSPIN        # Don't run witness on spinlocks for speed
options         VGA_WIDTH90
options         INCLUDE_CONFIG_FILE
nooptions       SMP
nodevice        atapifd
nodevice        atapist
nodevice        kbdmux
nodevice        splash
nooptions       INET6
nooptions       SCTP
nooptions       UFS_GJOURNAL
nooptions       MD_ROOT
nooptions       NFS_ROOT
nooptions       GEOM_PART_GPT
nooptions       GEOM_LABEL
nooptions       COMPAT_FREEBSD4
nooptions       COMPAT_FREEBSD5
nooptions       COMPAT_FREEBSD6
nooptions       COMPAT_FREEBSD7
nooptions       SCSI_DELAY
nooptions       KTRACE
nooptions       STACK
nooptions       AUDIT
nodevice        de
nodevice        em
nodevice        ixgb
nodevice        le
nodevice        ti
nodevice        txp
nodevice        vx
nodevice        age
nodevice        bce
nodevice        bfe
nodevice        bge
nodevice        dc
nodevice        et
nodevice        jme
nodevice        fxp
nodevice        lge
device          wlan_acl
device          wlan_xauth
device          smbus
device          ichsmb
device          smb
nodevice        sio
nodevice        ppc
nodevice        ppbus
nodevice        lpt
nodevice        plip
nodevice        ppi
nodevice        iwi
nodevice        ipf
nodevice        nfe
nodevice        nve
nodevice        arcmsr
nodevice        twa
nodevice        ncv
nodevice        nsp
nodevice        stg
nodevice        aac
nodevice        aacp
nodevice        hptmv
nodevice        htprr
nodevice        hptiop
nodevice        ips
nodevice        ahc
nodevice        ahd
nodevice        amd
nodevice        isp
nodevice        mpt
nodevice        sym
nodevice        trm
nodevice        adv
nodevice        adw
nodevice        aic
nodevice        bt
nodevice        sa
nodevice        amr
nodevice        ciss
nodevice        dpt
nodevice        iir
nodevice        mly
nodevice        ida
nodevice        mfi
nodevice        mlx
nodevice        twe

How-To-Repeat: plug device, after 3-5 seconds - unplug
Comment 1 f0andrey 2008-08-10 20:07:29 UTC
FreeBSD test.local 8.0-CURRENT FreeBSD 8.0-CURRENT #1: Sun Aug 10 01:50:24
MSD 2008     andrey@test.local:/usr/obj/usr/src/sys/MY  amd64

after
ubt0: ached

ubt0: <vendor 0x0a12 BT2.0, class 224/1, rev 2.00/31.64, addr 2> on uhub0
ubt0: Interface 0 endpoints: interrupt=0x81, bulk-in=0x82, bulk-out=0x2
ubt0: Interface 1 (alt.config 5) endpoints: isoc-in=0x83, isoc-out=0x3;
wMaxPacketSize=49; nframes=10, buffer size=490
WARNING: attempt to net_add_domain(bluetooth) after domainfinalize()
hardware_error:  - hardware error 0x37

after
ubt0: detached

Fatal trap 9: general protection fault while in kernel mode
cpuid = 1; apic id = 01
instruction pointer = 0x8: 0xffffffff8026c02b
stack pointer = 0x10: 0xfffffffe40171b20
frame pointer = 0x10: 0xfffffffe40171b60
code segment = base rx0, limit 0xfffff, type 0x1b
                       = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 12 (irq23: ohci0 ohci0)
[thread pid12 tid 100029]
Stopped at  uhci_transfer_complete+0x31:   movsbl  0x2(%rax),%r14d
db>

or

[thread pid12 tid 100029]
Stopped at  uhci_transfer_complete+0x31:   movsbl  0x2(%rax),%r14d
db> bt
Tracing pid 12 tid 100029 td 0xffffff00014d0000
uhci_transfer_complete() at uhci_transfer_complete+0x31
uhci_softintr() at uhci_softintr+0xd8
uhci_intr1() at uhci_intr1+0xdf
ithread_loop() at ithread_loop+0xda
fork_exit() at fork_exit+0x12a
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip=0. rsp = 0xfffffffe40171d30, rbp = 0 ---
Comment 2 Mark Linimon freebsd_committer freebsd_triage 2008-08-11 00:57:30 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-usb

Over to maintainer(s).
Comment 3 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:59:18 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped
Comment 4 Graham Perrin freebsd_committer freebsd_triage 2022-10-17 12:17:47 UTC
Keyword: 

    crash

– in lieu of summary line prefix: 

    [panic]

* bulk change for the keyword
* summary lines may be edited manually (not in bulk). 

Keyword descriptions and search interface: 

    <https://bugs.freebsd.org/bugzilla/describekeywords.cgi>