[Bug 297058] xhci_device_generic_enter umass page fault in snapshot amd64 20260720-7fc2c9f688ef

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297058

            Bug ID: 297058
           Summary: xhci_device_generic_enter umass page fault in snapshot
                    amd64 20260720-7fc2c9f688ef
           Product: Base System
           Version: 16.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: [email protected]
          Reporter: [email protected]

Installed:
FreeBSD-16.0-CURRENT-amd64-20260720-7fc2c9f688ef-287529-memstick.img.xz on a
WDC USB-flash device.

On boot it panics:

ugen0.4: <Western Digital My Passport 25F3> at usbus0
umass0 on uhub0
umass0: <Western Digital My Passport 25F3, class 0/0, rev 3.10/10.06, addr 3>
on usbus0
umass0:  SCSI over Bulk-Only; quirks = 0x0
umass0:2:0: Attached to scbus2
da0 at umass-sim0 bus 0 scbus2 target 0 lun 0
da0: <WD My Passport 25F3 1006> Fixed Direct Access SPC-4 SCSI device
da0: Serial Number 313732373134343230373734
da0: 400.000MB/s transfers
da0: 488354MB (1000148992 512 byte sectors)
da0: quirks=0x2<NO_6_BYTE>
ses0 at umass-sim0 bus 0 scbus2 target 0 lun 1
ses0: <WD SES Device 1006> Fixed Enclosure Services SPC-4 SCSI device
ses0: Serial Number 313732373134343230373734
ses0: 400.000MB/s transfers
ses0: SES Device
Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex xhci0 (usb_def_mtx) r = 1 (0xfffffe00d5dce870) locked @
/home/pkgbuild/worktrees/main/sys/dev/usb/usb_transfer.c:1892
exclusive sleep mutex umass0 (umass0) r = 0 (0xfffff800015d2d90) locked @
/home/pkgbuild/worktrees/main/sys/dev/usb/usb_transfer.c:2343
stack backtrace:
#0 0xffffffff80c8f03c at witness_debugger+0x6c
#1 0xffffffff80c9093c at witness_warn+0x4bc
#2 0xffffffff811a0767 at trap_pfault+0x97
#3 0xffffffff8116dea8 at calltrap+0x8
#4 0xffffffff809d9fab at xhci_device_generic_enter+0x15b
#5 0xffffffff809fe38a at usbd_pipe_enter+0x9a
#6 0xffffffff809fe189 at usb_command_wrapper+0x99
#7 0xffffffff809fdb19 at usbd_transfer_submit+0x639
#8 0xffffffff809df870 at umass_t_bbb_data_read_callback+0xf0
#9 0xffffffff809fcdce at usbd_callback_wrapper+0x89e
#10 0xffffffff809fe189 at usb_command_wrapper+0x99
#11 0xffffffff809fcf5e at usb_callback_proc+0x8e
#12 0xffffffff809f7860 at usb_process+0xf0
#13 0xffffffff80bbdad2 at fork_exit+0x82
#14 0xffffffff8116eece at fork_trampoline+0xe


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x8f6d02c
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff809e29e4
stack pointer           = 0x28:0xfffffe00d535dc90
frame pointer           = 0x28:0xfffffe00d535dc90
processor eflags        = interrupt enabled, resume, IOPL = 0
current thread          = 14/100062 (usb/usbus0)
rdi: 0000000008f6d000 rsi: 0000000008f74000 rdx: fffff800044b1630
rcx: 00000000000001c0  r8: fffff800044b1480  r9: 0000000000000002
rax: 0000000000000000 rbx: 000000000001c000 rbp: fffffe00d535dc90
r10: 0000000000001000 r11: 0000000000000000 r12: 0000000000000000
r13: 000000000001c3ff r14: fffff800044b1401 r15: 000000000000001c
panic: page fault
cpuid = 0
time = 4
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x36/frame 0xfffffe00d535d9c0
vpanic() at vpanic+0x149/frame 0xfffffe00d535daf0
panic() at panic+0x43/frame 0xfffffe00d535db50
trap_pfault() at trap_pfault+0x449/frame 0xfffffe00d535dbc0
calltrap() at calltrap+0x8/frame 0xfffffe00d535dbc0
--- trap 0xc, rip = 0xffffffff809e29e4, rsp = 0xfffffe00d535dc90, rbp =
0xfffffe00d535dc90 ---
usb_pc_cpu_flush() at usb_pc_cpu_flush+0x4/frame 0xfffffe00d535dc90
xhci_device_generic_enter() at xhci_device_generic_enter+0x15b/frame
0xfffffe00d535dd70
usbd_pipe_enter() at usbd_pipe_enter+0x9a/frame 0xfffffe00d535dd90
usb_command_wrapper() at usb_command_wrapper+0x99/frame 0xfffffe00d535ddb0
usbd_transfer_submit() at usbd_transfer_submit+0x639/frame 0xfffffe00d535ddf0
umass_t_bbb_data_read_callback() at umass_t_bbb_data_read_callback+0xf0/frame
0xfffffe00d535de30
usbd_callback_wrapper() at usbd_callback_wrapper+0x89e/frame 0xfffffe00d535de80
usb_command_wrapper() at usb_command_wrapper+0x99/frame 0xfffffe00d535dea0
usb_callback_proc() at usb_callback_proc+0x8e/frame 0xfffffe00d535dec0
usb_process() at usb_process+0xf0/frame 0xfffffe00d535def0
fork_exit() at fork_exit+0x82/frame 0xfffffe00d535df30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00d535df30
--- trap 0x75ff097b, rip = 0x8a0347880c468a02, rsp = 0x8a05478812468a08, rbp =
0x894810246c894808 ---
KDB: enter: panic
[ thread pid 14 tid 100062 ]
Stopped at      kdb_enter+0x33: movq    $0,0x119adb2(%rip)
db>

-- 
You are receiving this mail because:
You are the assignee for the bug.