kernel panic from usb device on 11.0

[Gerrit Kühn]

Hi all,

I have a SD-card reader that used to work fine on FreeBSD 8, 9 and 10.
However, after upgrading to 11.0, I can panic the system by trying to
use mount_msdosfs (just typed the mount command and waited, nothing else) on the card reader:

---
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): WRITE(10). CDB: 2a 00 00 00 00 fa 00 00 08 00 
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): CAM status: SCSI Status Error
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): SCSI status: Check Condition
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): SCSI sense: DATA PROTECT asc:27,0 (Write protected)
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Field Replaceable Unit: 1
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Command Specific Info: 0xaa5521
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Error 13, Unretryable error
Jan 13 16:51:05 comet kernel: g_vfs_done():da1s1[WRITE(offset=512, length=4096)]error = 13
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): WRITE(10). CDB: 2a 00 00 00 00 fa 00 00 08 00 
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): CAM status: SCSI Status Error
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): SCSI status: Check Condition
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): SCSI sense: DATA PROTECT asc:27,0 (Write protected)
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Field Replaceable Unit: 1
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Command Specific Info: 0xaa5521
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Error 13, Unretryable error
Jan 13 16:51:05 comet kernel: g_vfs_done():da1s1[WRITE(offset=512, length=4096)]error = 13
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): WRITE(10). CDB: 2a 00 00 00 00 fa 00 00 08 00 
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): CAM status: SCSI Status Error
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): SCSI status: Check Condition
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): SCSI sense: DATA PROTECT asc:27,0 (Write protected)
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Field Replaceable Unit: 1
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Command Specific Info: 0xaa5521
Jan 13 16:51:05 comet kernel: (da1:umass-sim2:2:0:0): Error 13, Unretryable error
Jan 13 16:51:05 comet kernel: g_vfs_done():da1s1[WRITE(offset=512, length=4096)]error = 13
Jan 13 16:51:05 comet kernel: fsync: giving up on dirty
Jan 13 16:51:05 comet kernel: 0xfffff80013f53b10: tag devfs, type VCHR
Jan 13 16:51:05 comet kernel: usecount 1, writecount 0, refcount 34 mountedhere 0xfffff80007865e00
Jan 13 16:51:05 comet kernel: flags (VI_ACTIVE)
Jan 13 16:51:05 comet kernel: v_object 0xfffff80013f93528 ref 0 pages 31 cleanbuf 31 dirtybuf 1
Jan 13 16:51:05 comet kernel: lock type devfs: UNLOCKED
Jan 13 16:51:05 comet kernel: dev da1s1
Jan 13 16:51:24 comet kernel: ugen8.4: <Generic> at usbus8 (disconnected)
Jan 13 16:51:24 comet kernel: umass2: at uhub11, port 3, addr 4 (disconnected)
Jan 13 16:51:24 comet kernel: da1 at umass-sim2 bus 2 scbus7 target 0 lun 0
Jan 13 16:51:24 comet kernel: da1: <Multi Flash Reader 1.00> s/n 058F0O1111B detached
Jan 13 16:51:24 comet kernel: (da1:umass-sim2:2:0:0): Periph destroyed
Jan 13 16:53:37 comet syslogd: kernel boot file is /boot/kernel/kernel
Jan 13 16:53:37 comet kernel: Device da1s1 went missing before all of the data could be written to it; expect data loss.
Jan 13 16:53:37 comet kernel: 
Jan 13 16:53:37 comet kernel: 
Jan 13 16:53:37 comet kernel: Fatal trap 9: general protection fault while in kernel mode
Jan 13 16:53:37 comet kernel: cpuid = 1; apic id = 01
Jan 13 16:53:37 comet kernel: instruction pointer       = 0x20:0xffffffff80a190cc
Jan 13 16:53:37 comet kernel: stack pointer             = 0x28:0xfffffe0121be8160
Jan 13 16:53:37 comet kernel: frame pointer             = 0x28:0xfffffe0121be81a0
Jan 13 16:53:37 comet kernel: code segment              = base 0x0, limit 0xfffff, type 0x1b
Jan 13 16:53:37 comet kernel: = DPL 0, pres 1, long 1, def32 0, gran 1
Jan 13 16:53:37 comet kernel: processor eflags  = interrupt enabled, resume, IOPL = 0
Jan 13 16:53:37 comet kernel: current process           = 1014 (hald-addon-storage)
Jan 13 16:53:37 comet kernel: trap number               = 9
Jan 13 16:53:37 comet kernel: panic: general protection fault
Jan 13 16:53:37 comet kernel: cpuid = 1
Jan 13 16:53:37 comet kernel: KDB: stack backtrace:
Jan 13 16:53:37 comet kernel: #0 0xffffffff80b24077 at kdb_backtrace+0x67
Jan 13 16:53:37 comet kernel: #1 0xffffffff80ad93e2 at vpanic+0x182
Jan 13 16:53:37 comet kernel: #2 0xffffffff80ad9253 at panic+0x43
Jan 13 16:53:37 comet kernel: #3 0xffffffff80fa0d51 at trap_fatal+0x351
Jan 13 16:53:37 comet kernel: #4 0xffffffff80fa09e8 at trap+0x768
Jan 13 16:53:37 comet kernel: #5 0xffffffff80f84141 at calltrap+0x8
Jan 13 16:53:37 comet kernel: #6 0xffffffff80b8adb7 at bufwrite+0x267
Jan 13 16:53:37 comet kernel: #7 0xffffffff80b9a650 at vop_stdfsync+0x290
Jan 13 16:53:37 comet kernel: #8 0xffffffff80985bb7 at devfs_fsync+0x67
Jan 13 16:53:37 comet kernel: #9 0xffffffff8110bbed at VOP_FSYNC_APV+0x8d
Jan 13 16:53:37 comet kernel: #10 0xffffffff80b8aef5 at bufsync+0x35
Jan 13 16:53:37 comet kernel: #11 0xffffffff80baa870 at bufobj_invalbuf+0x160
Jan 13 16:53:37 comet kernel: #12 0xffffffff80bae36e at vgonel+0x1fe
Jan 13 16:53:37 comet kernel: #13 0xffffffff80baeae1 at vgone+0x81
Jan 13 16:53:37 comet kernel: #14 0xffffffff8097e774 at devfs_delete+0x304
Jan 13 16:53:37 comet kernel: #15 0xffffffff8097ed0f at devfs_populate_loop+0x20f
Jan 13 16:53:37 comet kernel: #16 0xffffffff8097eaea at devfs_populate+0x2a
---


The thing is 100% reproducible. The system identifies as

Jan 13 16:53:37 comet kernel: FreeBSD 11.0-RELEASE-p2 #0: Mon Oct 24 06:55:27 UTC 2016
Jan 13 16:53:37 comet kernel: root at amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64


The reader attaches as

Jan 13 16:49:45 comet kernel: da1 at umass-sim2 bus 2 scbus7 target 0 lun 0
Jan 13 16:49:45 comet kernel: da1: <Multi Flash Reader 1.00> Removable Direct Access SCSI device
Jan 13 16:49:45 comet kernel: da1: Serial Number 058F0O1111B
Jan 13 16:49:45 comet kernel: da1: 40.000MB/s transfers
Jan 13 16:49:45 comet kernel: da1: 1938MB (3970048 512 byte sectors)
Jan 13 16:49:45 comet kernel: da1: quirks=0x2<NO_6_BYTE>


Is there anything I can do to get the reader working again (or at least prevent the kernel panics)?


cu
  Gerrit