ucom.c calling ttstart() without lock

[Brett Lymn <blymn%baesystems.com.au@localhost>]

While wandering around the codebase I noticed that in dev/usb/ucom.c
there is an indirect call to ttstart() (in sys/kern/tty.c) that does
not have the tty_lock held when called.  All the other calls of
ttstart() are bracketed by holds/releases of tty_lock.  Is the
attached patch the correct thing to do?

-- 
Brett Lymn
"Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited.  If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility.  It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer."

Index: dev/usb/ucom.c
===================================================================
RCS file: /s/NetBSD/cvsroot/src/sys/dev/usb/ucom.c,v
retrieving revision 1.77
diff -u -r1.77 ucom.c
--- dev/usb/ucom.c      24 May 2008 16:40:58 -0000      1.77
+++ dev/usb/ucom.c      13 Oct 2008 02:45:04 -0000
@@ -995,12 +995,14 @@
        cc -= sc->sc_opkthdrlen;
 
        s = spltty();
+       mutex_spin_enter(&tty_lock);    /* XXX */
        CLR(tp->t_state, TS_BUSY);
        if (ISSET(tp->t_state, TS_FLUSH))
                CLR(tp->t_state, TS_FLUSH);
        else
                ndflush(&tp->t_outq, cc);
        (*tp->t_linesw->l_start)(tp);
+       mutex_spin_exit(&tty_lock);     /* XXX */
        splx(s);
        return;