crash when disconnecting USB device

[Jukka Salmi <j+nbsd%2008.salmi.ch@localhost>]

Hello,

it seems that I can reproducibly crash a 4.99.65 i386 system by
connecting and disconnecting an USB device:

$ dmesg
[...]
uhci1 at pci0 dev 16 function 1: VIA Technologies VT83C572 USB Controller (rev. 
0x80)
uhci1: interrupting at irq 7
usb1 at uhci1: USB revision 1.0
[...]
uhub1 at usb1: VIA Technologies UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
[...]
umodem0 at uhub1 port 1 configuration 1 interface 1
umodem0: Sony Ericsson Sony Ericsson K750, rev 2.00/0.00, addr 2, iclass 2/2
umodem0: data interface 2, has CM over data, has break
umodem0: status change notification available
ucom0 at umodem0
umodem1 at uhub1 port 1 configuration 1 interface 3
umodem1: Sony Ericsson Sony Ericsson K750, rev 2.00/0.00, addr 2, iclass 2/2
umodem1: data interface 4, has CM over data, has break
umodem1: status change notification available
ucom1 at umodem1
umass0 at uhub1 port 1 configuration 1 interface 8
umass0: Sony Ericsson Sony Ericsson K750, rev 2.00/0.00, addr 2
umass0: using ATAPI over Bulk-Only
atapibus1 at umass0: 2 targets
sd0 at atapibus1 drive 0: <Sony Eri, Memory Stick, 0000> disk removable
sd0: drive offline
sd0(umass0:0:0):  Check Condition on CDB: 0x00 00 00 00 00 00
    SENSE KEY:  Not Ready
     ASC/ASCQ:  Medium Not Present

sd0: unable to open device, error = 19
umodem0: at uhub1 port 1 (addr 2) disconnected
uvm_fault(0xc050b380, 0, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c02e9594 cs 8 eflags 10286 cr2 19 ilevel 0
kernel: supervisor trap page fault, code=0
Stopped in pid 0.28 (system) at netbsd:config_deactivate+0x14:  movl    
0x14(%esi),%edx
db{0}> 
config_deactivate(5,1,3222dca4,0,c04c11a0,1,cc22dc7c,c02eb601,c2068f00,5) at 
netbsd:config_deactivate+0x14
config_deactivate(c2068f00,5,0,0,cc22dc8c,cc22dca4,0,c1b17500,1,4) at 
netbsd:config_deactivate+0x49
config_detach(c2068f00,1,c1a66c1c,c038959c,cacc7be0,c1a631b0,c1a66c1c,10,c1a631b0,c1b17500)
 at netbsd:config_detach+0xa1
usb_disconnect_port(c1a631b0,c1a66c00,10,c02e78d4,c04f8040,0,c1a63180,c1a5c980,1,108)
 at netbsd:usb_disconnect_port+0x5b
uhub_explore(c1a63c00,c1a17c40,cc22dd2c,c03f56f7,1770,0,c049ffc9,1770,0,c1a17c40)
 at netbsd:uhub_explore+0x124
usb_discover(1770,0,c049ffc9,1770,0,c1a17c40,0,c01002e1,c1a17c40,0) at 
netbsd:usb_discover+0x2a
usb_event_thread(c1a17c40,0,c01002cd,0,c01002cd,0,0,0,0,0) at 
[...]

This did not happen with 4.99.60. (However, the ENODEV device open
failure also happens with 4.99.50. Oddly enough it happens only the
first time the device is connected; subsequently disconnecting and
reconnecting it leads to a usable sd0...)

Any hints?


Regards, Jukka

-- 
bashian roulette:
$ ((RANDOM%6)) || rm -rf ~