Date: Sun, 16 Mar 2008 04:15:43 +0100 (CET) From: Marcin Cieslak <saper@SYSTEM.PL> To: FreeBSD-gnats-submit@FreeBSD.org Cc: usb@FreeBSD.org, saper@SYSTEM.PL, nike_d@cytexbg.com Subject: usb/121755: [patch] Fix panic after ohci/uhub cardbus device eject Message-ID: <200803160315.m2G3FhNu014253@radziecki.saper.info> Resent-Message-ID: <200803160320.m2G3K2Uk003306@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 121755
>Category: usb
>Synopsis: [patch] Fix panic after ohci/uhub cardbus device eject
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: freebsd-usb
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sun Mar 16 03:20:02 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Marcin Cieslak
>Release: FreeBSD 7.0-PRERELEASE amd64
>Organization:
>Environment:
System: FreeBSD radziecki.saper.info 7.0-PRERELEASE FreeBSD 7.0-PRERELEASE #9: Sat Jan 26 01:36:13 CET 2008 saper@radziecki.saper.info:/usr/obj/usr/src/sys/VAIO amd64
>Description:
When ejecting Cardbus card implementing OHCI inteface, one may get
panic: ohci_rem_ed: ED not found
or
ucom0: detached
(null): at uhub4 port 1 (addr 2) disconnected
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x400
fault code = supervisor read, page not present
instruction pointer = 0x20:0xc0661e84
stack pointer = 0x28:0xd4d63b4c
frame pointer = 0x28:0xd4d63b6c
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 31 (cbb0 event thread)
[thread pid 31 tid 100027 ]
Stopped at kobj_delete+0x14: movl 0x400(%eax),%ebx
when unplugging the device, as reported in this thread:
http://thread.gmane.org/gmane.os.freebsd.current/92196
http://thread.gmane.org/gmane.os.freebsd.current/92196/focus=100202
>How-To-Repeat:
Try removing Option GTMAX 7.2 3G UMTS modem device (also reported with HUAWEI
datacards).
>Fix:
First patch fixes the ohci_rem_ed panic, the next one fixes the kobj_delete
problem.
Index: ohci_pci.c
===================================================================
RCS file: /usr/home/ncvs/src/sys/dev/usb/ohci_pci.c,v
retrieving revision 1.50
diff -u -u -r1.50 ohci_pci.c
--- ohci_pci.c 21 Jun 2007 14:42:33 -0000 1.50
+++ ohci_pci.c 16 Mar 2008 01:33:07 -0000
@@ -348,6 +348,11 @@
{
ohci_softc_t *sc = device_get_softc(self);
+ if (sc->sc_bus.bdev) {
+ device_delete_child(self, sc->sc_bus.bdev);
+ sc->sc_bus.bdev = NULL;
+ }
+
if (sc->sc_flags & OHCI_SCFLG_DONEINIT) {
ohci_detach(sc, 0);
sc->sc_flags &= ~OHCI_SCFLG_DONEINIT;
@@ -367,10 +372,6 @@
err);
sc->ih = NULL;
}
- if (sc->sc_bus.bdev) {
- device_delete_child(self, sc->sc_bus.bdev);
- sc->sc_bus.bdev = NULL;
- }
if (sc->irq_res) {
bus_release_resource(self, SYS_RES_IRQ, 0, sc->irq_res);
sc->irq_res = NULL;
Index: usb_subr.c
===================================================================
RCS file: /usr/home/ncvs/src/sys/dev/usb/usb_subr.c,v
retrieving revision 1.95
diff -u -u -r1.95 usb_subr.c
--- usb_subr.c 30 Jun 2007 20:18:44 -0000 1.95
+++ usb_subr.c 16 Mar 2008 02:51:05 -0000
@@ -1379,8 +1379,6 @@
device_get_ivars(dev->subdevs[i]);
device_detach(dev->subdevs[i]);
free(uaap, M_USB);
- device_delete_child(device_get_parent(dev->subdevs[i]),
- dev->subdevs[i]);
dev->subdevs[i] = NULL;
}
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200803160315.m2G3FhNu014253>