From owner-freebsd-usb@FreeBSD.ORG  Wed Jun 20 06:57:30 2007
Return-Path: <owner-freebsd-usb@FreeBSD.ORG>
X-Original-To: freebsd-usb@freebsd.org
Delivered-To: freebsd-usb@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 7C88A16A41F
	for <freebsd-usb@freebsd.org>; Wed, 20 Jun 2007 06:57:30 +0000 (UTC)
	(envelope-from hselasky@c2i.net)
Received: from swip.net (mailfe10.swip.net [212.247.155.33])
	by mx1.freebsd.org (Postfix) with ESMTP id 1B98313C44B
	for <freebsd-usb@freebsd.org>; Wed, 20 Jun 2007 06:57:29 +0000 (UTC)
	(envelope-from hselasky@c2i.net)
X-Cloudmark-Score: 0.000000 []
Received: from [194.248.135.20] (account mc467741@c2i.net HELO laptop.lan)
	by mailfe10.swip.net (CommuniGate Pro SMTP 5.1.9)
	with ESMTPA id 354599964; Wed, 20 Jun 2007 08:57:27 +0200
From: Hans Petter Selasky <hselasky@c2i.net>
To: freebsd-usb@freebsd.org
Date: Wed, 20 Jun 2007 08:57:24 +0200
User-Agent: KMail/1.9.5
References: <46790374.8040903@yandex.ru>
In-Reply-To: <46790374.8040903@yandex.ru>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200706200857.25030.hselasky@c2i.net>
Cc: "R.Mahmatkhanov" <cvs-src@yandex.ru>
Subject: Re: Panic on post-freeze current with ucom
X-BeenThere: freebsd-usb@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: FreeBSD support for USB <freebsd-usb.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-usb>,
	<mailto:freebsd-usb-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-usb>
List-Post: <mailto:freebsd-usb@freebsd.org>
List-Help: <mailto:freebsd-usb-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-usb>,
	<mailto:freebsd-usb-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 20 Jun 2007 06:57:30 -0000

On Wednesday 20 June 2007 12:37, R.Mahmatkhanov wrote:
> Good Day.
>

Hi,

The parsing of the USB descriptors in general is not very fault tolerant in 
the old USB stack. Probably there is a missing range or NULL check somewhere.

Unfortunately my new USB stack does not yet compile on the latest 7-current. 
Else you should try that, and if that fixes the problem, the people still 
maintaining the old USB stack should backport the parsing routines for the 
USB descriptors.

--HPS

> I just move to latest -current/i386 after the code freeze. And i catch
> 100% reproduceble panic condition. It happens when i plug my mobile
> phone to USB port. How it does:
>
> ucom0: <CURITEL Incorporated CURITEL HX-550C USB Modem, class 2/0, rev
> 1.10/0.00, addr 2> on uhub1
> Fatal trap 12: page fault while in kernel mode cpuid = 0; apic id = 00
> fault virtual address = 0x4
> fault code = supervisor read, page not present
> instruction pointer = 0x20: 0xc06ca396
> stack pointer = 0x28: 0xdd30a760
> frame pointer = 0x28: 0xdd30a760
> code segment = base 0x0, limit 0xfffff, type = 0x1b, DPL 0, pres 1,
>              = def32 1, gran 1
> processor eflags = interrupt enabled, resume; IOPL = 0
> current process = 28 (usb1)
> [thread pid 28 tid 100023]
> Stopped at usb_get_interface_descruptor+0x6: movl 0x4(%eax), %eax
> db>
>