9.0-CURRENT - panic on detaching USB flash (not mounted)

Hi, All.


My system is fresh CURRENT:
FreeBSD btr.properlan.net 9.0-CURRENT FreeBSD 9.0-CURRENT #9 r197070: 
Thu Sep 10 21:40:35 MSD 2009 
butcher_at_btr.properlan.net:/usr/obj/usr/src/sys/GENERIC  amd64

I successful unmount my USB flash and got fatal trap when i removed it.

This portion from dmesg:

--- syscall (10, FreeBSD ELF64, unlink), rip = 0x8007316fc, rsp = 
0x7fffffffe218, rbp = 0x800803d28 ---
lock order reversal:
  1st 0xffffff0005a609d0 zfs (zfs) _at_ /usr/src/sys/kern/vfs_mount.c:1200
  2nd 0xffffff00059d0270 devfs (devfs) _at_ 
/usr/src/sys/ufs/ffs/ffs_vfsops.c:1345
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
_witness_debugger() at _witness_debugger+0x2e
witness_checkorder() at witness_checkorder+0x81e
__lockmgr_args() at __lockmgr_args+0xcf3
vop_stdlock() at vop_stdlock+0x39
VOP_LOCK1_APV() at VOP_LOCK1_APV+0x9b
_vn_lock() at _vn_lock+0x47
ffs_sync() at ffs_sync+0x2d7
dounmount() at dounmount+0x2ca
unmount() at unmount+0x27e
syscall() at syscall+0x1af
Xfast_syscall() at Xfast_syscall+0xe1
--- syscall (22, FreeBSD ELF64, unmount), rip = 0x8006a09dc, rsp = 
0x7fffffffe308, rbp = 0 ---
ugen3.2: <Prolific Technology Inc.> at usbus3 (disconnected)
uhub8: at uhub3, port 3, addr 2 (disconnected)
ugen3.3: <Prolific Technology Inc.> at usbus3 (disconnected)


Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x20:0xffffffff804c3b10
stack pointer           = 0x28:0xffffff80752399a0
frame pointer           = 0x28:0xffffff80752399c0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 14 (usbus3)
panic: from debugger
cpuid = 0
Uptime: 21m50s
Physical memory: 4077 MB

This from kgdb:

#0  doadump () at pcpu.h:223
#1  0xffffffff805826a3 in boot (howto=260)
     at /usr/src/sys/kern/kern_shutdown.c:416
#2  0xffffffff80582b2c in panic (fmt=)
     at /usr/src/sys/kern/kern_shutdown.c:579
#3  0xffffffff801d9057 in db_panic (addr=)
     at /usr/src/sys/ddb/db_command.c:478
#4  0xffffffff801d9501 in db_command (last_cmdp=0xffffffff80be9aa0, 
cmd_table=
) at /usr/src/sys/ddb/db_command.c:445
#5  0xffffffff801d9750 in db_command_loop ()
     at /usr/src/sys/ddb/db_command.c:498
#6  0xffffffff801db719 in db_trap (type=) at /usr/src/sys/ddb/db_main.c:229
#7  0xffffffff805b2295 in kdb_trap (type=9, code=0, tf=0xffffff80752398f0)
     at /usr/src/sys/kern/subr_kdb.c:535
#8  0xffffffff80866afd in trap_fatal (frame=0xffffff80752398f0, eva=)
     at /usr/src/sys/amd64/amd64/trap.c:847
#9  0xffffffff808675a6 in trap (frame=0xffffff80752398f0)
     at /usr/src/sys/amd64/amd64/trap.c:639
#10 0xffffffff8084d253 in calltrap ()
     at /usr/src/sys/amd64/amd64/exception.S:224
#11 0xffffffff804c3b10 in usbd_transfer_stop (xfer=0xffffff8000e6aa90)
     at /usr/src/sys/dev/usb/usb_transfer.c:1694
#12 0xffffffff804c4547 in usbd_transfer_drain (xfer=0xffffff8000e6aa90)
     at /usr/src/sys/dev/usb/usb_transfer.c:1786
#13 0xffffffff804c5065 in usbd_transfer_unsetup (pxfer=0xffffff0003a214b8,
     n_setup=) at /usr/src/sys/dev/usb/usb_transfer.c:1166
#14 0xffffffff804aadc7 in umass_detach (dev=)
     at /usr/src/sys/dev/usb/storage/umass.c:1662
#15 0xffffffff805ac29b in device_detach (dev=0xffffff0003a18400)
     at device_if.h:212
#16 0xffffffff805ac4e1 in device_delete_child (dev=0xffffff0003a18600,
     child=0xffffff0003a18400) at /usr/src/sys/kern/subr_bus.c:1820
#17 0xffffffff805ac4c4 in device_delete_child (dev=0xffffff000391ec00,
     child=0xffffff0003a18600) at /usr/src/sys/kern/subr_bus.c:1815
#18 0xffffffff804b6f88 in usb_unconfigure (udev=0xffffff00039a6000, flag=)
     at /usr/src/sys/dev/usb/usb_device.c:1022
#19 0xffffffff804b72cd in usb_free_device (udev=0xffffff00039a6000, flag=)
     at /usr/src/sys/dev/usb/usb_device.c:1985
#20 0xffffffff804bea38 in uhub_explore (udev=0xffffff0003974000)
     at /usr/src/sys/dev/usb/usb_hub.c:322
#21 0xffffffff804aab41 in usb_bus_explore (pm=)
     at /usr/src/sys/dev/usb/controller/usb_controller.c:239
#22 0xffffffff804c1290 in usb_process (arg=)
     at /usr/src/sys/dev/usb/usb_process.c:164
#23 0xffffffff8055a92a in fork_exit (
     callout=0xffffffff804c11d0 <usb_process>, arg=0xffffff80002f0d68,
     frame=0xffffff8075239c80) at /usr/src/sys/kern/kern_fork.c:843
#24 0xffffffff8084d72e in fork_trampoline ()
     at /usr/src/sys/amd64/amd64/exception.S:561
#25 0x0000000000000000 in ?? ()

-- 
WBR, Andrey V. Elsukov