usb stick removal panics

["Simon 'corecode' Schubert" <corecode@xxxxxxxxxxxx>]

hey,

repeatable panic here when removing my usb stick (when I didn't load umass.ko before):

Unread portion of the kernel message buffer:
uhub1: at uhub0 port 4 (addr 3) disconnected
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0xdeadc0de
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc0264ce0
stack pointer           = 0x10:0xd2465b20
frame pointer           = 0x10:0xd2465b20
code segment            = base 0x0, limit 0xfffff, type 0x1b
                       = DPL 0, pres 1, def32 1, gran 1
processor eflags        = resume, IOPL = 0
current process         = Idle
current thread          = pri 76 (CRIT)

trap number             = 12
panic: page fault
[...]
(kgdb) bt
#0  dumpsys () at thread.h:83
#1  0xc017c8a7 in boot (howto=256) at /usr/build/src/sys/kern/kern_shutdown.c:373
#2  0xc017c9d1 in panic (fmt=Variable "fmt" is not available.
) at /usr/build/src/sys/kern/kern_shutdown.c:792
#3  0xc029185a in trap_fatal (frame=0xd2465ad8, eva=Variable "eva" is not available.
)
   at /usr/build/src/sys/platform/pc32/i386/trap.c:1097
#4  0xc02919ad in trap_pfault (frame=0xd2465ad8, usermode=0, eva=3735929054)
   at /usr/build/src/sys/platform/pc32/i386/trap.c:998
#5  0xc02922dc in trap (frame=0xd2465ad8) at /usr/build/src/sys/platform/pc32/i386/trap.c:681
#6  0xc02830d6 in calltrap () at /usr/build/src/sys/platform/pc32/i386/exception.s:783
#7  0xc0264ce0 in strlen (str=0xdeadc0de <Address 0xdeadc0de out of bounds>)
   at /usr/build/src/sys/libkern/strlen.c:44
#8  0xc0194fc8 in kvcprintf (fmt=0xc02c566d ": at %s", func=0xc01959de <kputchar>, arg=0xd2465c50, 
   radix=10, ap=0xd2465c78 "�u\036�) at /usr/build/src/sys/kern/subr_prf.c:655
#9  0xc01959b0 in kprintf (fmt=0xc02c566b "%s: at %s") at /usr/build/src/sys/kern/subr_prf.c:304
#10 0xc025c561 in usb_disconnect_port (up=0xd53d9c68, parent=0xd53d98d8)
   at /usr/build/src/sys/bus/usb/usb_subr.c:1382
#11 0xc025f3d2 in uhub_detach (self=0xd53d98d8) at /usr/build/src/sys/bus/usb/uhub.c:610
#12 0xc018e850 in device_detach (dev=0xd53d98d8) at device_if.h:49
#13 0xc018e943 in device_delete_child (dev=0xcfaea500, child=0xd53d98d8)
   at /usr/build/src/sys/kern/subr_bus.c:600
#14 0xc025c5b0 in usb_disconnect_port (up=0xd24a5c74, parent=0xcfaea500)
   at /usr/build/src/sys/bus/usb/usb_subr.c:1387
#15 0xc025f119 in uhub_explore (dev=0xcfa8a8b8) at /usr/build/src/sys/bus/usb/uhub.c:460
#16 0xc025985f in usb_discover (v=Variable "v" is not available.
) at /usr/build/src/sys/bus/usb/usb.c:784
#17 0xc0259bf6 in usb_event_thread (arg=0xc22491c0) at /usr/build/src/sys/bus/usb/usb.c:473
#18 0xc017181a in suspend_kproc (td=Variable "td" is not available.
) at /usr/build/src/sys/kern/kern_kthread.c:158

seems either some variable isn't being initialized correctly, or something is freed prematurely.  no time to investigate, though.

The USB stick I'm using has an integrated USB hub (why is beyond my imagination).

cheers
 simon

--
Serve - BSD     +++  RENT this banner advert  +++    ASCII Ribbon   /"\
Work - Mac      +++  space for low €€€ NOW!1  +++      Campaign     \ /
Party Enjoy Relax   |   http://dragonflybsd.org      Against  HTML   \
Dude 2c 2 the max   !   http://golden-apple.biz       Mail + News   / \

Attachment: signature.asc
Description: OpenPGP digital signature