Date: Mon, 3 Jun 2002 12:11:14 +0400 (MSD) From: Paul Argentoff <argentoff@rtelekom.ru> To: FreeBSD-gnats-submit@FreeBSD.org Subject: kern/38848: kernel panic when removing memory stick from MSAC-US1 device Message-ID: <200206030811.g538BEGr030346@snark.rtelekom.ru>
next in thread | raw e-mail | index | archive | help
>Number: 38848
>Category: kern
>Synopsis: kernel panic when removing memory stick from MSAC-US1 device
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Mon Jun 03 01:20:01 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator: Paul Argentoff <argentoff@rtelekom.ru>
>Release: FreeBSD 4.5-RELEASE i386
>Organization:
Ratmir-TeleKom, Tver, Russian Federation
>Environment:
System: FreeBSD a15.ratmir.tver.ru 4.5-RELEASE FreeBSD 4.5-RELEASE #1: Wed May 29 18:18:51 MSD 2002 root@a15.ratmir.tver.ru:/usr/src/sys/compile/A15-KRON i386
>Description:
Sometimes (very often) when I remove a memory stick from MSAC-US1 (USB memory
stick reader from SONY), I get the following panic (here's the typescript of a
gdb session):
--- gdb-session begins here ---
Script started on Wed May 29 18:53:43 2002
[root@a15 crash]# gdb -k kernel.debug vmcore.6
GNU gdb 4.18
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i386-unknown-freebsd"...
IdlePTD at phsyical address 0x00301000
initial pcb at physical address 0x00266040
panicstr: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x4
fault code = supervisor read, page not present
instruction pointer = 0x8:0xc01bd58e
stack pointer = 0x10:0xc0243e68
frame pointer = 0x10:0xc0243e70
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = Idle
interrupt mask = bio
trap number = 12
panic: page fault
syncing disks...
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x30
fault code = supervisor read, page not present
instruction pointer = 0x8:0xc019c598
stack pointer = 0x10:0xc0243c8c
frame pointer = 0x10:0xc0243c94
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = Idle
interrupt mask = bio
trap number = 12
panic: page fault
Uptime: 1m23s
dumping to dev #ad/0x30004, offset 892952
dump ata0: resetting devices .. done
63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
---
#0 dumpsys () at ../../kern/kern_shutdown.c:474
474 if (dumping++) {
(kgdb) where
#0 dumpsys () at ../../kern/kern_shutdown.c:474
#1 0xc0140458 in boot (howto=260) at ../../kern/kern_shutdown.c:313
#2 0xc014085d in panic (fmt=0xc023b80c "%s") at ../../kern/kern_shutdown.c:582
#3 0xc01fdf08 in trap_fatal (frame=0xc0243c4c, eva=48) at ../../i386/i386/trap.c:956
#4 0xc01fdb9d in trap_pfault (frame=0xc0243c4c, usermode=0, eva=48) at ../../i386/i386/trap.c:849
#5 0xc01fd72f in trap (frame={tf_fs = -1072300016, tf_es = 6815760, tf_ds = -1071382512, tf_edi = 0,
tf_esi = -1064190976, tf_ebp = -1071367020, tf_isp = -1071367048, tf_ebx = -1071303940,
tf_edx = 6832224, tf_ecx = -971604736, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1072052840,
tf_cs = 8, tf_eflags = 66054, tf_esp = -1064190976, tf_ss = -1064190976})
at ../../i386/i386/trap.c:448
#6 0xc019c598 in acquire_lock (lk=0xc02532fc) at ../../ufs/ffs/ffs_softdep.c:271
#7 0xc01a070c in softdep_update_inodeblock (ip=0xc091bc00, bp=0xc1d25874, waitfor=0)
at ../../ufs/ffs/ffs_softdep.c:3775
#8 0xc019b6a6 in ffs_update (vp=0xc6167d00, waitfor=0) at ../../ufs/ffs/ffs_inode.c:106
#9 0xc01a3c4a in ffs_sync (mp=0xc08eea00, waitfor=2, cred=0xc05ab400, p=0xc0279500)
at ../../ufs/ffs/ffs_vfsops.c:1014
#10 0xc0170e07 in sync (p=0xc0279500, uap=0x0) at ../../kern/vfs_syscalls.c:547
#11 0xc014022b in boot (howto=256) at ../../kern/kern_shutdown.c:234
#12 0xc014085d in panic (fmt=0xc023b80c "%s") at ../../kern/kern_shutdown.c:582
#13 0xc01fdf08 in trap_fatal (frame=0xc0243e28, eva=4) at ../../i386/i386/trap.c:956
#14 0xc01fdb9d in trap_pfault (frame=0xc0243e28, usermode=0, eva=4) at ../../i386/i386/trap.c:849
#15 0xc01fd72f in trap (frame={tf_fs = -1071382512, tf_es = -1071972336, tf_ds = -1063387120, tf_edi = 1,
tf_esi = -1064330496, tf_ebp = -1071366544, tf_isp = -1071366572, tf_ebx = -1064579264, tf_edx = 64,
tf_ecx = 0, tf_eax = 0, tf_trapno = 12, tf_err = 0, tf_eip = -1071917682, tf_cs = 8,
tf_eflags = 66055, tf_esp = -1064330496, tf_ss = -1064611840}) at ../../i386/i386/trap.c:448
#16 0xc01bd58e in uhci_check_intr (sc=0xc08b5000, ii=0xc08f9b00) at ../../dev/usb/uhci.c:1029
#17 0xc01bd517 in uhci_intr (arg=0xc08b5000) at ../../dev/usb/uhci.c:990
(kgdb) up 16
#16 0xc01bd58e in uhci_check_intr (sc=0xc08b5000, ii=0xc08f9b00) at ../../dev/usb/uhci.c:1029
1029 for (std = ii->stdstart; std != lstd; std = std->link.std) {
(kgdb) up 1
#17 0xc01bd517 in uhci_intr (arg=0xc08b5000) at ../../dev/usb/uhci.c:990
990 uhci_check_intr(sc, ii);
(kgdb) q
[root@a15 crash]# exit
Script done on Wed May 29 18:54:24 2002
--- gdb-session ends here ---
>How-To-Repeat:
For example, (though it's not the only situation when the problem arises) one
can reproduce the panic removing a memory stick shortly after it's been inserted
into the reader (while usbd is still registering the device in the system).
>Fix:
No idea.
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200206030811.g538BEGr030346>