>Number:         7939
>Category:       kern
>Synopsis:       Usage of ulpt0 crashs the system
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jul  7 17:20:00 1999
>Last-Modified:
>Originator:     Bjoern Labitzke
>Organization:
Bjoern Labitzke  <hermit@cs.tu-berlin.de>
   Use PGP! (Don't you use envelopes for your letters?)
>Release:        last -current before ELF-change (Friday I guess) <NetBSD-current source date>
>Environment:
	
System: NetBSD labitzke.isdn.cs.tu-berlin.de 1.4D NetBSD 1.4D (LABITZKE) #88: Sun Jul 4 22:26:26 CEST 1999 root@labitzke.isdn.cs.tu-berlin.de:/usr/src/sys/arch/i386/compile/LABITZKE i386


>Description:
Excerpt from my dmesg:
uhci0 at pci0 dev 4 function 2: Intel 82371AB USB Host Controller (PIIX4) (rev.
0x01)
uhci0: interrupting at irq 10
uhci0: USB version 1.0
usb0 at uhci0
uhub0 at usb0
uhub0: Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
ulpt0 at uhub0 port 1 configuration 1 interface 0
ulpt0: Brother Industries Corp. HL-1050 laser printer, rev 1.00/1.00, addr 2, ic
lass 7/1

Printing to this device with ghostscript or other tools crashs the system
and produces the following message:

kernel: page fault trap, code=0
Stopped in usb0 at _usbd_close_pipe+0x7  movl 0xc(%ebx),%eax

A trace shows:

_usbd_close_pipe
_ulptclose
_spec_close
_ufsspec_close
_vclean
_vgonel
_genfs_revoke
_vdevgone
_ulpt_detach
_config_detach
_uhub_disconnect_port
_uhub_explore
_usb_discover
_usb_event_thread
Bad frame pointer 0xf0299ea8

(According to Lennart Augustsson those names suffice.)

This fault is reproducable.
	
>How-To-Repeat:
Try to print to ulpt0.
	
>Fix:
Wish I knew one...
	
>Audit-Trail:
>Unformatted: