Re: USB card reader (umass) panic on FreeBSD 5.3-STABLE

On Sat, Oct 30, 2004 at 05:21:55PM +0200, Martin wrote:
> 
> Hi,
> 
> it's a while ago that I reported a panic when attaching
> a USB card reader device. The panic still exists and
> the behavior has not changed.
> 
> If I can help somehow to solve this problem, please message me.
> 
> System:
> FreeBSD 5.3-STABLE #0: Wed Oct 27 01:31:39 CEST 2004
> 
> Earlier PR:
> http://www.freebsd.org/cgi/query-pr.cgi?pr=i386/65783
> 
> umass0: ICSI 2.0 Card Reader, rev 2.00/3a, addr 3
> da0: at umass-sim0 bus 0 target 0 lun 0
> da0: <ICSI CF CARD       CF 1.3A> Removable Direct Access SCSI-0 device
> da0: 1.000MB/s transfers
> da0: 122MB (250368 512 byte sectors: 64H 32S/T 122C)
> da1: at umass-sim0 bus 0 target 0 lun 1
> da1: <ICSI MS Card       MS 1.3A> Removable Direct Access SCSI-0 device
> da1: 1.000MB/s transfers
> da1: Attempt to query device size failed: NOT READY, Medium not present
> (da2:umass-sim0:0:0:2): READ CAPACITY. CDB: 25 40 0 0 0 0 0 0 0 0
> (da2:umass-sim0:0:0:2): ILLEGAL REQUEST asc:25,0
> (da2:umass-sim0:0:0:2): Logical unit not supported
> (da2:umass-sim0:0:0:2): fatal error, failed to attach to device
> (da2:umass-sim0:0:0:2): lost device
> (da2:umass-sim0:0:0:2): removing device entry
> (da2:umass-sim0:0:0:3): READ CAPACITY. CDB: 25 60 0 0 0 0 0 0 0 0
> (da2:umass-sim0:0:0:3): ILLEGAL REQUEST asc:25,0
> (da2:umass-sim0:0:0:3): Logical unit not supported
> (da2:umass-sim0:0:0:3): fatal error, failed to attach to device
> (da2:umass-sim0:0:0:3): lost device
> (da2:umass-sim0:0:0:3): removing device entry
> 
> Fatal trap 12: page fault while in kernel mode
> fault virtual address   = 0x3c
> fault code              = supervisor write, page not present
> instruction pointer     = 0x8:0xc05731dc
> stack pointer           = 0x10:0xd01b7cac
> frame pointer           = 0x10:0xd01b7cb8
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, def32 1, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 2 (g_event)
> [thread 100026]
> Stopped at      g_disk_destroy+0xc: movl        $0,0x3c(%eax)
> db> trace
> g_disk_destroy(c20b9d80,0,0,c080a3a3,0) at g_disk_destroy+0xc
> one_event(66666667,c05767c0,0,d01b7d10,c05767e5) at one_event+0x225
> g_run_events(c087c39c,0,4c,c080a3a3,64) at g_run_events+0x15
> g_event_procbody(0,d01b7d48,0,0,0) at g_event_procbody+0x25
> fork_exit(c05767c0,0,d01b7d48) at fork_exit+0x80
> fork_trampoline() at fork_trampoline+0x8
> --- trap 0x1, eip = 0, esp = 0xd01b7d7c, ebp = 0 ---
> 
> The card reader has got 4 slots. Only the first one is in use
> and the Compact flash card is recognized correctly. But then
> the kernel scans the empty slots and panics. The first empty
> slot is handled right, I think.

This looks like a GEOM bug.  You're getting two posted g_disk_destroy
events in rapid succession -- i.e. for the same disk device structures
in memory -- and they are racing and both running after both disks
have been created and then freed, from what I can tell.

-- 
Brian Fundakowski Feldman                           \'[ FreeBSD ]''''''''''\
  <> green_at_FreeBSD.org                               \  The Power to Serve! \
 Opinions expressed are my own.                       \,,,,,,,,,,,,,,,,,,,,,,\