Panic on CardBus card eject (ubsa(4))

Hi,

I got a new CardBus 3G modem today, a Huawei E620, which is supported
by the ubsa(4) driver. However, ejecting the card produces the
following panic:

Script started on Mon Jul 30 17:48:49 2007
lothlorien# kgdb kernel /var/crash/vmcore.3
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
ucom0: detached
(null): at uhub5 port 1 (addr 2) disconnected


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x400
fault code		= supervisor read, page not present
instruction pointer	= 0x20:0xc0634c08
stack pointer	        = 0x28:0xe3f4fb48
frame pointer	        = 0x28:0xe3f4fb68
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 37 (cbb0 event thread)
trap number		= 12
panic: page fault
cpuid = 1
Uptime: 28m23s
Physical memory: 1006 MB
Dumping 83 MB: 68 52 36 20 4

#0  doadump () at pcpu.h:195
195		__asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc060e59a in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc060e86d in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc07e8f5e in trap_fatal (frame=0xe3f4fb08, eva=Variable "eva" is not available.
) at /usr/src/sys/i386/i386/trap.c:870
#4  0xc07e91ae in trap_pfault (frame=0xe3f4fb08, usermode=0, eva=1024) at /usr/src/sys/i386/i386/trap.c:784
#5  0xc07e9a98 in trap (frame=0xe3f4fb08) at /usr/src/sys/i386/i386/trap.c:462
#6  0xc07d1d3b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc0634c08 in kobj_delete (obj=0xc4547e00, mtype=0xc0894320) at /usr/src/sys/kern/subr_kobj.c:332
#8  0xc062f122 in device_delete_child (dev=0xc4559180, child=0xc4547e00) at /usr/src/sys/kern/subr_bus.c:1617
#9  0xc059ea7c in usb_disconnect_port (up=0xc4559430, parent=0xc4559180) at /usr/src/sys/dev/usb/usb_subr.c:1382
#10 0xc0594d84 in uhub_detach (self=0xc4559180) at /usr/src/sys/dev/usb/uhub.c:575
#11 0xc062eedc in device_detach (dev=0xc4559180) at device_if.h:212
#12 0xc062f0bf in device_delete_child (dev=0xc4194080, child=0xc4559180) at /usr/src/sys/kern/subr_bus.c:1611
#13 0xc062f0aa in device_delete_child (dev=0xc454da80, child=0xc4194080) at /usr/src/sys/kern/subr_bus.c:1606
#14 0xc058be62 in ohci_pci_detach (self=0xc454da80) at /usr/src/sys/dev/usb/ohci_pci.c:371
#15 0xc062eedc in device_detach (dev=0xc454da80) at device_if.h:212
#16 0xc04eb32b in cardbus_detach_card (cbdev=0xc3c4b600) at /usr/src/sys/dev/cardbus/cardbus.c:235
#17 0xc0537f95 in cbb_event_thread (arg=0xc3b79000) at card_if.h:95
#18 0xc05effd1 in fork_exit (callout=0xc0537df0 <cbb_event_thread>, arg=0xc3b79000, frame=0xe3f4fd38)
    at /usr/src/sys/kern/kern_fork.c:797
#19 0xc07d1db0 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205
(kgdb) up 7
#7  0xc0634c08 in kobj_delete (obj=0xc4547e00, mtype=0xc0894320) at /usr/src/sys/kern/subr_kobj.c:332
332		kobj_class_t cls = obj->ops->cls;
(kgdb) print obj->ops
$1 = 0x0
(kgdb) quit
lothlorien# exit
Script done on Mon Jul 30 17:49:36 2007

Anybody seen this before?

This is with -current from yesterday:

$ uname -a
FreeBSD lothlorien.brixandersen.dk 7.0-CURRENT FreeBSD 7.0-CURRENT #59: Sun Jul 29 13:32:00 CEST 2007     root_at_lothlorien.brixandersen.dk:/usr/obj/usr/src/sys/LOTHLORIEN  i386

Regards,
Brix
-- 
Henrik Brix Andersen <henrik_at_brixandersen.dk>