>Number:         24393
>Category:       kern
>Synopsis:       current kernel crashes when disconnecting USB mass storage device
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Feb 11 21:02:00 UTC 2004
>Closed-Date:
>Last-Modified:
>Originator:     Jukka Salmi
>Release:        NetBSD 1.6ZJ
>Organization:
>Environment:
System: NetBSD 1.6ZJ (GENERIC) #0: Tue Feb 10 17:21:34 CET 2004        root@himo.salmi.ch:/opt/src/nbsd/current/sys/arch/i386/compile/obj/GENERIC i386
Architecture: i386
Machine: i386

partial dmesg output (USB stuff):

uhci0 at pci0 dev 17 function 2: VIA Technologies VT83C572 USB Controller (rev. 0x1b)
uhci0: interrupting at irq 9
usb0 at uhci0: USB revision 1.0
uhub0 at usb0
uhub0: VIA Technologies UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1 at pci0 dev 17 function 3: VIA Technologies VT83C572 USB Controller (rev. 0x1b)
uhci1: interrupting at irq 9
usb1 at uhci1: USB revision 1.0
uhub1 at usb1
uhub1: VIA Technologies UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhci2 at pci0 dev 17 function 4: VIA Technologies VT83C572 USB Controller (rev. 0x1b)
uhci2: interrupting at irq 9
usb2 at uhci2: USB revision 1.0
uhub2 at usb2
uhub2: VIA Technologies UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
[...]
uhub0: port error, restarting port 1
uhub0: port error, giving up port 1
uhub0: port error, restarting port 2
uhub0: port error, giving up port 2
uhub1: port error, restarting port 1
uhub1: port error, giving up port 1
uhub1: port error, restarting port 2
uhub1: port error, giving up port 2
[...]
umass0 at uhub0 port 1 configuration 1 interface 0
umass0: NIKON NIKON DSC E3700, rev 1.10/1.00, addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <NIKON, NIKON DSC E3700, 1.00> disk removable
sd0: fabricating a geometry
sd0: 241 MB, 241 cyl, 64 head, 32 sec, 512 bytes/sect x 494080 sectors
sd0: fabricating a geometry

>Description:
When detaching an USB mass storage device which is mounted without unmounting
it my current kernel crashes.
>How-To-Repeat:
(attach device)
# mount -t msdos -r /dev/sd0e /mnt
(detach device)
umass0: at uhub0 port 1 (addr 2) disconnected
sd0(umass0:0:0:0): generic HBA error
uvm_fault(0xc079e320, 0, 0, 1) -> 0xe
kernel: page fault trap, code=0
Stopped in pid 5.1 (usb0) at    0:      invalid address
db> tr
uvm_fault(0xc079e320, 0, 0, 1) -> 0xe
kernel: page fault trap, code=0
Faulted in DDB; continuing...
db> 
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted: