kern/44192: Kernel panic while printing with USB printer

[jkab9041%gmail.com@localhost]

>Number:         44192
>Category:       kern
>Synopsis:       Kernel panic while printing with USB printer
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Dec 05 13:55:00 +0000 2010
>Originator:     John K.
>Release:        NetBSD 5.1/i386
>Organization:
>Environment:
NetBSD x.y.z 5.1 NetBSD 5.1 (GENERIC) #0: Sun Dec  5 13:03:06 CET 2010  
a%x.y.z@localhost:/usr/src/sys/arch/i386/compile/GENERIC i386
>Description:
While attempting to print with my USB printer I get random kernel panics.

The printer is Samsung ML-1640:
ulpt0 at uhub0 port 3 configuration 1 interface 0
ulpt0: Samsung Electronics Co., Ltd. ML-1640 Series, rev 1.10/1.00, addr 4, 
iclass 7/1
ulpt0: using bi-directional mode

Software used: CUPS + foomatic-filters (from pkgsrc) + splix (from pkgsrc-wip).

After turning the printer on, the first job is ALWAYS sent and printed
correctly. All succesive print jobs sent to the printer result in random
behavior:

        the job may be printed correctly (very seldom),

        or the diode on the printer just blinks once and nothing is printed (in 
this
        case the job is sent, lpq shows no jobs in queue). This happens most
        frequently.

Eventually after several tries the kernel panics. There may be 2, 5, 20 print
attempts, but the crash is inevitable.

When I turn the printer off and on, again I can print one job and then after
some tries the kernel crashes.

Message from syslog:

fatal page fault in supervisor mode
trap type 6 code 2 eip c03b3fdd cs 8 eflags 10246 cr2 0 ilevel 2
panic: trap
Begin traceback...
fatal page fault in supervisor mode
trap type 6 code 0 eip c0347541 cs 8 eflags 10246 cr2 2 ilevel 2
panic: trap

Backtrace (GENERIC recompiled with debugging support):

#0  0xc058de02 in cpu_reboot (howto=260, bootstr=0x0)
    at ../../../../arch/i386/i386/machdep.c:924
#1  0xc04cfc10 in panic (fmt=0xc0a7658e "trap")
    at ../../../../kern/subr_prf.c:253
#2  0xc0590b47 in trap (frame=0xcb5b8a8c)
    at ../../../../arch/i386/i386/trap.c:368
#3  0xc010cbe0 in calltrap ()
#4  0xc05890c1 in db_read_bytes (addr=2, size=4, data=0xcb5b8afc 
"ě\213[Ë\004")
    at ../../../../arch/i386/i386/db_memrw.c:91
#5  0xc01b3637 in db_get_value (addr=2, size=4, is_signed=false)
    at ../../../../ddb/db_access.c:62
#6  0xc0589a5a in db_stack_trace_print (addr=-883192852, have_addr=true, 
    count=65535, modif=0xc0aaa6d0 "", pr=0xc04cf9f0 <printf>)
    at ../../../../arch/i386/i386/db_trace.c:147
#7  0xc04cfbe5 in panic (fmt=0xc0a7658e "trap")
    at ../../../../kern/subr_prf.c:242
#8  0xc0590b47 in trap (frame=0xcb5b8c90)
    at ../../../../arch/i386/i386/trap.c:368
#9  0xc010cbe0 in calltrap ()
#10 0xc0774f1d in usbd_setup_xfer (xfer=0x0, pipe=0x0, priv=0xcb729e8c, 
    buffer=0xcc32a000, length=4096, flags=5, timeout=10, 
    callback=0xc0789150 <ulpt_read_cb>) at ../../../../dev/usb/usbdi.c:402
#11 0xc0789131 in ulpt_tick (xsc=0xcb729e8c) at ../../../../dev/usb/ulpt.c:947
#12 0xc04be66c in callout_softclock (v=0x0)
    at ../../../../kern/kern_timeout.c:731
#13 0xc04b38d4 in softint_dispatch (pinned=0xcb187c80, s=2)
    at ../../../../kern/kern_softint.c:539
#14 0xc0100ecd in Xsoftintr ()
#15 0x00000000 in ?? ()


0.      0xc058de02 <cpu_reboot+194>:    0xffff4fe9
1.      0xc04cfc10 <panic+416>: 0x22083589
2.      0xc0590b47 <trap+903>:  0x0fa87d83
3.      0xc010cbe0 <calltrap+13>:       0xf604c483
4.      0xc05890c1 <db_read_bytes+49>:  0x0289068b
5.      0xc01b3637 <db_get_value+39>:   0x31ff4b8d
6.      0xc0589a5a <db_stack_trace_print+1258>: 0xffffff3d
7.      0xc04cfbe5 <panic+373>: 0xba2404c7
8.      0xc0590b47 <trap+903>:  0x0fa87d83
9.      0xc010cbe0 <calltrap+13>:       0xf604c483
10.     0xc0774f1d <usbd_setup_xfer+13>:        0x558b1089
11.     0xc0789131 <ulpt_tick+97>:      0x8928438b
12.     0xc04be66c <callout_softclock+332>:     0x4489c031
13.     0xc04b38d4 <softint_dispatch+100>:      0x082404c7
14.     0xc0100ecd <Xsoftintr+61>:      0xfa08c483
>How-To-Repeat:
On my system turn the printer on and just try printing. The crash is inevitable 
(though unpredictable).
>Fix:
This problem in FreeBSD (already fixed) looks similar:
http://www.freebsd.org/cgi/query-pr.cgi?pr=78208&cat=