usb/78986: crash when printing to usb connected printer

[Marc van Kempen]

>Number:         78986
>Category:       usb
>Synopsis:       crash when printing to usb connected printer
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-usb
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Mar 18 15:00:07 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Marc van Kempen
>Release:        FreeBSD 5.3-STABLE i386
>Organization:
>Environment:
System: FreeBSD e16014.upc-e.chello.nl 5.3-STABLE FreeBSD 5.3-STABLE #9: Fri Feb 25 10:54:15 CET 2005 marc at e107252.upc-e.chello.nl:/usr/obj/usr/ncvs/src/sys/JUNG i386

AMD Athlon XP 1500+
1Gb Memory

>Description:
Every once in a while, printing to my Samsung ML-1510 laserprinter connected
through usb will completely lock up the computer.
	
>How-To-Repeat:
Print several times until it locks up. The problem is that there doesn't 
seem to be a pattern to it.

Here is a stacktrace:

> ulpt0: Samsung Electronics Co., Ltd. Samsung ML-1510_700, rev 
1.10/1.00, addr
+3, iclass 7/1
 > ulpt0: using bi-directional mode
 >
 > Fatal trap 12: page fault while in kernel mode
 > fault virtual address = 0x4c
 > fault code            = supervisor read, page not present
 > instruction pointer   = 0x8:0xc04e6be9
 > stack pointer         = 0x10:0xefe71b04
 > frame pointer         = 0x10:0xefe71b20
 > code segment          = base 0x0, limit 0xfffff, type 0x1b
 >                       = DPL 0, pres 1, def32 1, gran 1
 > processor eflags      = interrupt enabled, resume, IOPL = 0
 > current process               = 68367 (lpd)
 > trap number           = 12
 > panic: page fault
 > KDB: stack backtrace:
 > kdb_backtrace(100,c3bb6c80,10,efe71ac4,c) at kdb_backtrace+0x29
 > panic(c06d3bfd,c07003ba,0,fffff,c33be79b) at panic+0xa8
 > trap_fatal(efe71ac4,4c,c3bb6c80,c275ca8c,c) at trap_fatal+0x27c
 > trap_pfault(efe71ac4,0,4c) at trap_pfault+0x1cf
 > trap(18,10,10,0,c684e300) at trap+0x2ed
 > calltrap() at calltrap+0x5
 > --- trap 0xc, eip = 0xc04e6be9, esp = 0xefe71b04, ebp = 0xefe71b20 ---
 > usb_transfer_complete(c2e22c00) at usb_transfer_complete+0xcd
 > uhci_abort_xfer(c2e22c00,6,efe71b5c,c04e6b03,c2e22c00) at 
uhci_abort_xfer+0xcf
 > uhci_device_bulk_abort(c2e22c00) at uhci_device_bulk_abort+0xd
 > usbd_ar_pipe(c684e300) at usbd_ar_pipe+0x1f
 > usbd_abort_pipe(c684e300,c5574a50,efe71ba4,c0500048,c074b258) at
+usbd_abort_pipe+0xb
 > ulptclose(c074b258,2,2000,c3bb6c80,c071a400) at ulptclose+0x92
 > spec_close(efe71bbc,efe71be4,c05958a4,efe71bbc,c07403a0) at 
spec_close+0x310
 > spec_vnoperate(efe71bbc) at spec_vnoperate+0x13
 > vn_close(c5574a50,2,c6850300,c3bb6c80,efe71c14) at vn_close+0x40
 > vn_closefile(c2e47cc0,c3bb6c80) at vn_closefile+0xc2
 > fdrop_locked(c2e47cc0,c3bb6c80,0,efe71ccc,c05189e7) at fdrop_locked+0xa4
 > fdrop(c2e47cc0,c3bb6c80,c0740960,c6676948,0) at fdrop+0x41
 > closef(c2e47cc0,c3bb6c80,0,c33be710,0) at closef+0x237
 > close(c3bb6c80,efe71d14,1,0,292) at close+0x169
 > syscall(2f,2f,2f,805a67f,805f080) at syscall+0x27b

>Fix:
No known fix.
>Release-Note:
>Audit-Trail:
>Unformatted: