Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 8 Feb 2005 23:29:58 -0800 (PST)
From:      Steve Watt <steve@Watt.COM>
To:        FreeBSD-gnats-submit@FreeBSD.org
Subject:   usb/77294: ucom + ulpcom panic
Message-ID:  <200502090729.j197Twto002157@wattres.watt.com>
Resent-Message-ID: <200502090730.j197UKh3043060@freefall.freebsd.org>

next in thread | raw e-mail | index | archive | help

>Number:         77294
>Category:       usb
>Synopsis:       ucom + ulpcom panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-usb
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Feb 09 07:30:19 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Steve Watt
>Release:        FreeBSD 5.3-STABLE i386
>Organization:
Watt Consultants
>Environment:
System: FreeBSD wattres.Watt.COM 5.3-STABLE FreeBSD 5.3-STABLE #4: Tue Feb 8 21:28:10 PST 2005 root@wattres.Watt.COM:/usr/obj/usr/src/sys/WATTRES i386

Freshly updated to 5-STABLE as of 9 Feb 2005 06:09 GMT.

usbdevs says:
(root@wattres) 15# usbdevs -dv
Controller /dev/usb0:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), VIA(0x0000), rev 1.00
  uhub0
 port 1 powered
 port 2 powered
Controller /dev/usb1:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), VIA(0x0000), rev 1.00
  uhub1
 port 1 addr 2: full speed, self powered, config 1, Generic USB Hub(0x9254), ALCOR(0x058f), rev 3.12
   uhub2
  port 1 addr 3: full speed, power 500 mA, config 1, PL2303 Serial adapter (ATEN/IOGEAR UC232A)(0x2303), Prolific Technology(0x067b), rev 2.02
    ucom0
  port 2 addr 4: full speed, power 500 mA, config 1, PL2303 Serial adapter (ATEN/IOGEAR UC232A)(0x2303), Prolific Technology(0x067b), rev 2.02
    ucom1
  port 3 addr 5: full speed, power 500 mA, config 1, PL2303 Serial adapter (ATEN/IOGEAR UC232A)(0x2303), Prolific Technology(0x067b), rev 2.02
    ucom2
  port 4 powered
 port 2 powered
Controller /dev/usb2:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), VIA(0x0000), rev 1.00
  uhub3
 port 1 powered
 port 2 powered


>Description:
I get reproducable panic()s that look like a NULL pointer dereference.

What I saw on the console:

putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks
putc to a clist with no reserved blocks

ucom1: read start failed

fatal trap 12 in kernel mode
fault virtual address = 0x4c
[ ... ]
current process = getty
stopped at usb_transfer_complete+0xd2:   movl    0x4c(%eax),%eax

The traceback from ddb looks like:
db> trace
Tracing pid 1148 tid 100196 td 0xc1ceb960
usb_transfer_complete(c1e8c300,2,c1e8c36c,c1d75980,c1564e00) at usb_transfer_complete+0xd2
uhci_abort_xfer(c1e8c300,6,d025e9e4,c05fbd4b,c1e8c300) at uhci_abort_xfer+0xf5
uhci_device_bulk_abort(c1e8c300,c15a8500,d025e9f0,c05fba87,c1d75980) at uhci_device_bulk_abort+0x19
usbd_ar_pipe(c1d75980,d025e9fc,c0a8c22c,c1d75980,d025ea18) at usbd_ar_pipe+0x22
usbd_abort_pipe(c1d75980,d025ea18,c0a8bd30,c15a8500,1) at usbd_abort_pipe+0x11
ucomstopread(c15a8500,1,c1564e00,3,c1ceae20) at ucomstopread+0x28
ucomstop(c1564e00,3,fffffffd,4,d025ead0) at ucomstop+0x49
ttyflush(c1564e00,3,0,c1b0c400,c1564e00) at ttyflush+0x43
ttioctl(c1564e00,80047410,d025ec54,3,c1ceb960) at ttioctl+0x916
ttyioctl(c09861f8,80047410,d025ec54,3,c1ceb960) at ttyioctl+0x66
ucomioctl(c09861f8,80047410,d025ec54,3,c1ceb960) at ucomioctl+0x68
spec_ioctl(d025eb7c,d025ec28,c06d55d8,d025eb7c,c1b1bb28) at spec_ioctl+0x16a
spec_vnoperate(d025eb7c,c1b1bb28,c1e93e70,c1b1bb28,d025ebc8) at spec_vnoperate+0x18
vn_ioctl(c1b1bb28,80047410,d025ec54,c146cd80,c1ceb960) at vn_ioctl+0x196
ioctl(c1ceb960,d025ed14,c,c1ceb960,d025ed3c) at ioctl+0x692
syscall[...]


>How-To-Repeat:
Have a getty running on ucom1 (or ucom0 or ucom2)
kermit
kermit> set carrier-watch off
kermit> set line /dev/ucom1
[ kermit hangs ]
^Z
# kill %

System dies here.


>Fix:

	


>Release-Note:
>Audit-Trail:
>Unformatted:



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200502090729.j197Twto002157>