>Number:         33726
>Category:       kern
>Synopsis:       Plugging in USB memory stick panics netbsd-3
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 14 09:25:00 +0000 2006
>Originator:     Hauke Fath <hf@spg.tu-darmstadt.de>
>Release:        NetBSD 3.0_STABLE
>Organization:
-- 
/~\  The ASCII Ribbon Campaign                      Hauke Fath
\ /    No HTML/RTF in email	          Institut für Nachrichtentechnik
 X     No Word docs in email	                    TU Darmstadt
/ \  Respect for open standards                Ruf +49-6151-16-3281
>Environment:
	
	
System: NetBSD Isskogel.nt.e-technik.tu-darmstadt.de 3.0_STABLE NetBSD 3.0_STABLE (SPG_PIII) #0: Wed May 31 13:18:31 CEST 2006 hf@Gstoder.nt.e-technik.tu-darmstadt.de:/var/obj/netbsd-builds/3_0/i386/sys/arch/i386/compile/SPG_PIII i386
Architecture: i386
Machine: i386
>Description:

	Plugging in a 256 MB USB memory stick in a P4 i386 machine resulted
	in

umass0 at uhub2 port 3 configuration 1 interface 0
umass0: SMI Corporation USB DISK, rev 2.00/30.00, addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <SMI, USB DISK, 3000> disk removable
uvm_fault(0xc0641fc0, 0xcbe74000, 0, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c03a31f2 cs 8 eflags 10202 cr2 cbe740cc ilevel 0
panic: trap
Begin traceback...
trap() at netbsd:trap+0x149
--- trap (number 6) ---
sd_get_parms_page5(c20b4400,c20b4524,4,c1beca00,cbe73d48) at netbsd:sd_get_parms_page5+0x7e
sd_get_parms(c20b4400,c20b4524,4,1,c0597693) at netbsd:sd_get_parms+0x51
sdattach(c1ad16c0,c20b4400,cbe73e74,cbe73e70,c0610024) at netbsd:sdattach+0x220
config_attach_loc(c1ad16c0,c060ffec,cbe73e64,cbe73e74,c039d198) at netbsd:config_attach_loc+0x284
scsi_probe_device(c1ad16c0,0,0,0,0) at netbsd:scsi_probe_device+0x374
scsi_probe_bus(c1ad16c0,ffffffff,ffffffff,0,0) at netbsd:scsi_probe_bus+0xd7
scsibus_config(c1c10e38,c1ad16c0,0,0,0) at netbsd:scsibus_config+0x55
scsipi_completion_thread(c1c10e38,6f9000,701000,0,c0100321) at netbsd:scsipi_completion_thread+0x202
End traceback...
syncing disks... 4 4 4 3 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 giving up

dumping to dev 0,1 offset 1935623
[...]

The USB ports are probed as

uhci0 at pci2 dev 6 function 0: VIA Technologies VT83C572 USB Controller (rev. 0x50)
uhci0: interrupting at irq 5
usb0 at uhci0: USB revision 1.0
uhub0 at usb0
uhub0: VIA Technologies UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1 at pci2 dev 6 function 1: VIA Technologies VT83C572 USB Controller (rev. 0x50)
uhci1: interrupting at irq 9
usb1 at uhci1: USB revision 1.0
uhub1 at usb1
uhub1: VIA Technologies UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
ehci0 at pci2 dev 6 function 2: VIA Technologies VT8237 EHCI USB Controller (rev. 0x51)
ehci0: interrupting at irq 5
ehci0: BIOS has given up ownership
ehci0: EHCI version 0.95
ehci0: companion controllers, 2 ports each: uhci0 uhci1
usb2 at ehci0: USB revision 2.0
uhub2 at usb2
uhub2: VIA Technologie EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub2: single transaction translator
uhub2: 4 ports with 4 removable, self powered


>How-To-Repeat:

	Plug USB stick into machine. Watch it core and
	reboot. Happened once, so far, and might not be strictly
	reproducible, but since it gave a nice stack trace, I am
	turning it in anyway. 

	I can provide the coredump (0.5 GB) if it is of any help.

>Fix:
	Yes, please.

>Unformatted: