usb: panic when pulling a keyboard

[Lucius Windschuh]

Hi.
As I pulled my Apple keyboard (2 external ports uhub + ukbd) this
morning from my machine, it generated a panic.
This one is reproducible by pulling the keyboard from the machine when
rc.d/geli asks for a password.
Simply pulling the keyboard at any moment does not lead to the panic,
but in this special case, it does.
BTW: The panic does not happen if I use a "pure" ukbd/ums PS2-to-USB
adaptor without integrated hub.

A text- and minidump is available. Kernel: 8.0-BETA2, r196161

Kernel log:
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0xdeadc0fa
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc05f20f9
stack pointer           = 0x28:0xe8e99ad8
frame pointer           = 0x28:0xe8e99b10
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 45 (usbus7)

Backtrace:
#10 0xc05f20f9 in usb_unconfigure (udev=0xc6c0e000, flag=Variable
"flag" is not available.
) at /usr/src/sys/dev/usb/usb_device.c:1913
1913                    LIST_REMOVE(pd, pd_next);
Current language:  auto; currently c
(kgdb)
#11 0xc05f23de in usb_free_device (udev=0xc6c0e000, flag=Variable
"flag" is not available.
) at /usr/src/sys/dev/usb/usb_device.c:1983
1983            usb_unconfigure(udev, flag);
(kgdb)
#12 0xc05f9433 in uhub_detach (dev=0xc6c1ac00) at
/usr/src/sys/dev/usb/usb_hub.c:910
910                     usb_free_device(child,
(kgdb)
#13 0xc06d9dd6 in device_detach (dev=0xc6c1ac00) at device_if.h:212
212     device_if.h: No such file or directory.
        in device_if.h
(kgdb)
#14 0xc05f2038 in usb_unconfigure (udev=0xc6bcd000, flag=Variable
"flag" is not available.
) at /usr/src/sys/dev/usb/usb_device.c:1020
1020                            if (device_detach(dev)) {
(kgdb)
#15 0xc05f23de in usb_free_device (udev=0xc6bcd000, flag=Variable
"flag" is not available.
) at /usr/src/sys/dev/usb/usb_device.c:1983
1983            usb_unconfigure(udev, flag);
(kgdb)
#16 0xc05fa24c in uhub_explore (udev=0xc6bcf400) at
/usr/src/sys/dev/usb/usb_hub.c:324
324                     usb_free_device(child,
(kgdb)
#17 0xc05ea107 in usb_bus_explore (pm=0xc6923dd4) at
/usr/src/sys/dev/usb/controller/usb_controller.c:235
235                     (udev->hub->explore) (udev);
(kgdb)
#18 0xc05fc8de in usb_process (arg=0xc6923d74) at
/usr/src/sys/dev/usb/usb_process.c:161
161                             (pm->pm_callback) (pm);
(kgdb)
#19 0xc0688bf8 in fork_exit (callout=0xc05fc800 <usb_process>,
arg=0xc6923d74, frame=0xe8e75d38)
    at /usr/src/sys/kern/kern_fork.c:838
838             callout(arg, frame);
(kgdb)
#20 0xc09290b0 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:270
270             call    fork_exit

I'm willing to play remote hands on the gdb for further analysis.

Lucius