port-i386/39568: system stale while mounting a usb flash with a msdos fs

[Bernd Ernesti <pr200815%veego.de@localhost>]

>Number:         39568
>Category:       port-i386
>Synopsis:       system stale while mounting a usb flash with a msdos fs
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-i386-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Sep 16 21:10:01 +0000 2008
>Originator:     Bernd Ernesti
>Release:        NetBSD 4.99.71 (right before the wapbl changes)
>Organization:
        
>Environment:
System: NetBSD 4.99.71
Architecture: i386
Machine: i386
>Description:
        All file system access stopped while trying to mount a usb flash:

ehci0 at pci0 dev 2 function 2: NVIDIA nForce3 250 USB2 Host Controller (rev. 
0xa2)
[..]
ehci0: interrupting at ioapic0 pin 22
ehci0: EHCI version 1.0
ehci0: companion controllers, 4 ports each: ohci0 ohci1
usb2 at ehci0: USB revision 2.0
[..]
uhub2 at usb2: NVIDIA EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub2: 8 ports with 8 removable, self powered
[..]
umass0 at uhub2 port 1 configuration 1 interface 0
umass0: Corsair Voyager GT, rev 2.00/11.00, addr 2
umass0: using SCSI over Bulk-Only
scsibus0 at umass0: 2 targets, 1 lun per target
sd0 at scsibus0 target 0 lun 0: <Corsair, VoyagerGT, 1100> disk removable
sd0: fabricating a geometry
sd0: 15488 MB, 15488 cyl, 64 head, 32 sec, 512 bytes/sect x 31719424 sectors
sd0: fabricating a geometry
umass0: BBB bulk-out stall clear failed, TIMEOUT
umass0: BBB reset failed, TIMEOUT
umass0: BBB bulk-in clear stall failed, TIMEOUT
umass0: BBB bulk-out clear stall failed, TIMEOUT
umass0: BBB bulk-out stall clear failed, TIMEOUT
umass0: BBB reset failed, TIMEOUT
[loops forever]

Entering ddb shows this:

db{0}> mach cpu 0
using CPU 0
db{0}> bt
breakpoint(0,3f8,5,c043d01d,c0927c0c,c2ee210c,c090fe40,c2f77000,c2f78000,800) 
at netbsd:breakpoint+0x4
comintr(c2ee2000,ce3cdcb8,0,0,0,0,0,0,0,0) at netbsd:comintr+0x575
DDB lost frame for netbsd:Xintr_ioapic_edge2+0xa9, trying 0xce965f74
Xintr_ioapic_edge2() at netbsd:Xintr_ioapic_edge2+0xa9
--- interrupt ---
--- switch to interrupt stack ---
x86_stihlt(cc1c7be0,0,c0420fa7,cc1c7be0,0,0,c08a4088,cc1c7be0,c0419ea0,cc1c7be0)
 at netbsd:x86_stihlt+0x5
idle_loop(cc1c7be0,0,c01002cd,0,c01002cd,0,0,0,0,0) at netbsd:idle_loop+0x176
db{0}> mach cpu 1
using CPU 1
db{0}> bt
x86_stihlt(cc1ca280,0,0,0,0,0,c2f2e048,40,ce96fda0,c08a4ed8) at 
netbsd:x86_stihlt+0x5
idle_loop(0,c0419ea0,cc1ca280,c01002d0,0,c01002cd,0,c01002cd,0,0) at 
netbsd:idle_loop+0x176
Bad frame pointer: 0xcc1ca280

And I got this while trying to sync in ddb:

db{0}> sync
syncing disks... 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 giving up
Printing vnodes for busy buffers
vnode @ 0xcfbb150c, flags (2000030<MPSAFE,LOCKSWORK,SOFTDEP>)
        tag VT_UFS(1), type VBLK(3), usecount 62, writecount 0, holdcount 37
        freelisthd 0x0, mount 0xcfb7c004, data 0xcfc74d38 lock 0xcfbb15ac 
recursecnt 0
        tag VT_UFS, ino 92860, on dev 0, 0 flags 0x0, effnlink 1, nlink 1
        mode 060640, owner 0, group 5, size 0
vnode @ 0xcfbb150c, flags (2000030<MPSAFE,LOCKSWORK,SOFTDEP>)
        tag VT_UFS(1), type VBLK(3), usecount 62, writecount 0, holdcount 37
        freelisthd 0x0, mount 0xcfb7c004, data 0xcfc74d38 lock 0xcfbb15ac 
recursecnt 0
        tag VT_UFS, ino 92860, on dev 0, 0 flags 0x0, effnlink 1, nlink 1
        mode 060640, owner 0, group 5, size 0
giving up

>How-To-Repeat:
        mount -o ro /dev/sd0e /mnt
>Fix: