serious issue caused by usb device, stalling almost all operations

hi there,

i'm running HEAD (r213495; amd64). i stumbled upon this severe problem:

after attaching my mobile phone, it simply resets without doing mount or
anything. however after letting the device come up again it won't show up in
the console. after detaching it the usb subsystem seemed to have completely
crashed. but that's not all. the following programs now simply hang without
producing any output C-C won't do anything:

- dmesg
- top
- ps
- killall
- camcontrol devlist
- usbconfig

i cannot even kill the apps, since top and ps aren't working so there's no way
to find out the PIDs. using 'killall dmesg' e.g. won't work either, since
killall will also stall.

this is the console output which i could grab with
'vidcontrol -H -P < /dev/ttyv0' (since dmesg doesn't work anymore):

ugen3.3: <Samsung> at usbus3
umass0: <USB Mass Storage Interface> on usbus3
(probe0:umass-sim0:0:0:0): TEST UNIT READY. CDB: 0 0 0 0 0 0
(probe0:umass-sim0:0:0:0): CAM status: SCSI Status Error
(probe0:umass-sim0:0:0:0): SCSI status: Check Condition
(probe0:umass-sim0:0:0:0): SCSI sense: UNIT ATTENTION asc:28,0 (Not ready to rea
dy change, medium may have changed)
da0 at umass-sim0 bus 0 scbus9 target 0 lun 0
da0: <Samsung SGH-i550 1.0> Removable Direct Access SCSI-0 device
da0: 40.000MB/s transfers
da0: 3777MB (7736320 512 byte sectors: 255H 63S/T 481C)
(da0:umass-sim0:0:0:0): AutoSense failed
ugen3.3: <Samsung> at usbus3 (disconnected)
umass0: at uhub8, port 3, addr 3 (disconnected)
(da0:umass-sim0:0:0:0): AutoSense failed
(da0:umass-sim0:0:0:0): lost device
(da0:umass-sim0:0:0:0): Invalidating pack
(da0:umass-sim0:0:0:0): Synchronize cache failed, status == 0xa, scsi status ==
0x0
(da0:umass-sim0:0:0:0): removing device entry
lock order reversal:
 1st 0xffffffff80a37d50 GEOM topology (GEOM topology) _at_ /usr/src/sys/geom/label/
g_label.c:320
 2nd 0xffffffff808387a0 sysctl lock (sysctl lock) _at_ /usr/src/sys/kern/kern_sysct
l.c:257
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x35
kdb_backtrace() at kdb_backtrace+0x4e
_witness_debugger() at _witness_debugger+0x29
witness_checkorder() at witness_checkorder+0xad2
_sx_xlock() at _sx_xlock+0xae
sysctl_ctx_free() at sysctl_ctx_free+0x2e
dacleanup() at dacleanup+0x65
camperiphfree() at camperiphfree+0x152
cam_periph_release_locked() at cam_periph_release_locked+0x84
cam_periph_release() at cam_periph_release+0x6d
daclose() at daclose+0x223
g_disk_access() at g_disk_access+0x21c
g_access() at g_access+0x3b7
g_label_taste() at g_label_taste+0x3be
g_new_provider_event() at g_new_provider_event+0x145
one_event() at one_event+0x2d5
g_run_events() at g_run_events+0xe
g_event_procbody() at g_event_procbody+0x8b
fork_exit() at fork_exit+0xfd
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffff800003ecf0, rbp = 0 ---

cheers.
alex

-- 
a13x