>Number:         17599
>Category:       kern
>Synopsis:       panic when disconnecting a USB camera from a USB hub.
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 14 19:35:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Simon Burge
>Release:        NetBSD 1.6D
>Organization:
Wasabi Systems
>Environment:
	System: NetBSD euclid 1.6D NetBSD 1.6D (EUCLID)
	#327: Sun Jul 14 23:04:26 EST 2002
	simonb@euclid:/usr/obj/sys/arch/i386/compile/EUCLID i386
	Architecture: i386
	Machine: i386
	Dell 5000e laptop.
	Generic USB hub.
	Sony DSC-P31 digital camera.

>Description:
        I've got a Dell 5000e laptop.  I removed a USB mouse from
        the in-built USB port, plugged in a generic USB hub, plugged
        the mouse in (worked fine), plugged a Sony digital camera in
        (attached umass but didn't attach scsibus0 or sd0).  When I
        turned the camera off, I got a "fatal page fault in supervisor
        mode" panic.

        Here's the dmesg from when the mouse was unplugged (with the
        args to the functions trimmed for readability).  I've got a
        crash dump too of that's useful.

	uhidev0: at uhub0 port 1 (addr 2) disconnected
	wsmouse1 detached
	ums0 detached
	uhidev0 detached
	uhub1 at uhub0 port 1
	uhub1: Genesys Logic USB Hub, class 9/0, rev 1.01/0.05, addr 2
	uhub1: 7 ports with 7 removable, self powered
	uhidev0 at uhub1 port 1 configuration 1 interface 0
	uhidev0: Microsoft Microsoft IntelliMouse\M-. Explorer, rev 1.10/1.14, addr 3, iclass 3/1
	ums0 at uhidev0: 5 buttons and Z dir.
	wsmouse1 at ums0 mux 0
	umass0 at uhub1 port 4 configuration 1 interface 0
	umass0: Sony Sony DSC, rev 1.10/4.10, addr 4
	umass0: using RBC over CBI
	umass0: at uhub1 port 4 (addr 4) disconnected
	uvm_fault(0xc037f2e0, 0x0, 0, 1) -> e
	fatal page fault in supervisor mode
	trap type 6 code 0 eip c02c1257 cs 8 eflags 10287 cr2 fec cpl c0000000
	panic: trap
	Begin traceback...
	trap() at trap+0x206
	--- trap (number 6) ---
	usbd_ar_pipe(...) at usbd_ar_pipe+0x1b
	usbd_abort_pipe(...) at usbd_abort_pipe+0x27
	umass_detach(...) at umass_detach+0x30
	config_detach(...) at config_detach+0x3d
	usb_disconnect_port(...) at usb_disconnect_port+0x83
	uhub_explore(...) at uhub_explore+0x14d
	uhub_explore(...) at uhub_explore+0x27a
	usb_discover(...) at usb_discover+0x24
	usb_event_thread(...) at usb_event_thread+0x45
	End traceback...
	syncing disks... 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 5 3 2 done

>How-To-Repeat:
	See description above.
>Fix:
	None supplied.
>Release-Note:
>Audit-Trail:
>Unformatted: