From owner-freebsd-usb@FreeBSD.ORG Wed Feb 9 07:30:20 2005 Return-Path: Delivered-To: freebsd-usb@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A37EF16A4CE for ; Wed, 9 Feb 2005 07:30:20 +0000 (GMT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6821943D2D for ; Wed, 9 Feb 2005 07:30:20 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.1/8.13.1) with ESMTP id j197UKV6043061 for ; Wed, 9 Feb 2005 07:30:20 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.1/8.13.1/Submit) id j197UKh3043060; Wed, 9 Feb 2005 07:30:20 GMT (envelope-from gnats) Resent-Date: Wed, 9 Feb 2005 07:30:20 GMT Resent-Message-Id: <200502090730.j197UKh3043060@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-usb@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Steve Watt Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D20D616A4CE for ; Wed, 9 Feb 2005 07:29:58 +0000 (GMT) Received: from wattres.watt.com (wattres.watt.com [66.93.133.130]) by mx1.FreeBSD.org (Postfix) with ESMTP id 95E9843D49 for ; Wed, 9 Feb 2005 07:29:58 +0000 (GMT) (envelope-from steve@Watt.COM) Received: from wattres.watt.com (localhost.watt.com [127.0.0.1]) by wattres.watt.com (8.13.1/8.13.1) with ESMTP id j197TwSK002158 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 8 Feb 2005 23:29:58 -0800 (PST) (envelope-from steve@wattres.watt.com) Received: (from steve@localhost) by wattres.watt.com (8.13.1/8.13.1/Submit) id j197Twto002157; Tue, 8 Feb 2005 23:29:58 -0800 (PST) (envelope-from steve) Message-Id: <200502090729.j197Twto002157@wattres.watt.com> Date: Tue, 8 Feb 2005 23:29:58 -0800 (PST) From: Steve Watt To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Subject: usb/77294: ucom + ulpcom panic X-BeenThere: freebsd-usb@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Steve Watt List-Id: FreeBSD support for USB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Feb 2005 07:30:20 -0000 >Number: 77294 >Category: usb >Synopsis: ucom + ulpcom panic >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-usb >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Feb 09 07:30:19 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Steve Watt >Release: FreeBSD 5.3-STABLE i386 >Organization: Watt Consultants >Environment: System: FreeBSD wattres.Watt.COM 5.3-STABLE FreeBSD 5.3-STABLE #4: Tue Feb 8 21:28:10 PST 2005 root@wattres.Watt.COM:/usr/obj/usr/src/sys/WATTRES i386 Freshly updated to 5-STABLE as of 9 Feb 2005 06:09 GMT. usbdevs says: (root@wattres) 15# usbdevs -dv Controller /dev/usb0: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), VIA(0x0000), rev 1.00 uhub0 port 1 powered port 2 powered Controller /dev/usb1: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), VIA(0x0000), rev 1.00 uhub1 port 1 addr 2: full speed, self powered, config 1, Generic USB Hub(0x9254), ALCOR(0x058f), rev 3.12 uhub2 port 1 addr 3: full speed, power 500 mA, config 1, PL2303 Serial adapter (ATEN/IOGEAR UC232A)(0x2303), Prolific Technology(0x067b), rev 2.02 ucom0 port 2 addr 4: full speed, power 500 mA, config 1, PL2303 Serial adapter (ATEN/IOGEAR UC232A)(0x2303), Prolific Technology(0x067b), rev 2.02 ucom1 port 3 addr 5: full speed, power 500 mA, config 1, PL2303 Serial adapter (ATEN/IOGEAR UC232A)(0x2303), Prolific Technology(0x067b), rev 2.02 ucom2 port 4 powered port 2 powered Controller /dev/usb2: addr 1: full speed, self powered, config 1, UHCI root hub(0x0000), VIA(0x0000), rev 1.00 uhub3 port 1 powered port 2 powered >Description: I get reproducable panic()s that look like a NULL pointer dereference. What I saw on the console: putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks putc to a clist with no reserved blocks ucom1: read start failed fatal trap 12 in kernel mode fault virtual address = 0x4c [ ... ] current process = getty stopped at usb_transfer_complete+0xd2: movl 0x4c(%eax),%eax The traceback from ddb looks like: db> trace Tracing pid 1148 tid 100196 td 0xc1ceb960 usb_transfer_complete(c1e8c300,2,c1e8c36c,c1d75980,c1564e00) at usb_transfer_complete+0xd2 uhci_abort_xfer(c1e8c300,6,d025e9e4,c05fbd4b,c1e8c300) at uhci_abort_xfer+0xf5 uhci_device_bulk_abort(c1e8c300,c15a8500,d025e9f0,c05fba87,c1d75980) at uhci_device_bulk_abort+0x19 usbd_ar_pipe(c1d75980,d025e9fc,c0a8c22c,c1d75980,d025ea18) at usbd_ar_pipe+0x22 usbd_abort_pipe(c1d75980,d025ea18,c0a8bd30,c15a8500,1) at usbd_abort_pipe+0x11 ucomstopread(c15a8500,1,c1564e00,3,c1ceae20) at ucomstopread+0x28 ucomstop(c1564e00,3,fffffffd,4,d025ead0) at ucomstop+0x49 ttyflush(c1564e00,3,0,c1b0c400,c1564e00) at ttyflush+0x43 ttioctl(c1564e00,80047410,d025ec54,3,c1ceb960) at ttioctl+0x916 ttyioctl(c09861f8,80047410,d025ec54,3,c1ceb960) at ttyioctl+0x66 ucomioctl(c09861f8,80047410,d025ec54,3,c1ceb960) at ucomioctl+0x68 spec_ioctl(d025eb7c,d025ec28,c06d55d8,d025eb7c,c1b1bb28) at spec_ioctl+0x16a spec_vnoperate(d025eb7c,c1b1bb28,c1e93e70,c1b1bb28,d025ebc8) at spec_vnoperate+0x18 vn_ioctl(c1b1bb28,80047410,d025ec54,c146cd80,c1ceb960) at vn_ioctl+0x196 ioctl(c1ceb960,d025ed14,c,c1ceb960,d025ed3c) at ioctl+0x692 syscall[...] >How-To-Repeat: Have a getty running on ucom1 (or ucom0 or ucom2) kermit kermit> set carrier-watch off kermit> set line /dev/ucom1 [ kermit hangs ] ^Z # kill % System dies here. >Fix: >Release-Note: >Audit-Trail: >Unformatted: