>Number:         11815
>Category:       kern
>Synopsis:       removing CardBus USB (OHCI) card sometimes causes panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Dec 26 01:21:00 PST 2000
>Closed-Date:
>Last-Modified:
>Originator:     ITOH Yasufumi
>Release:        1.5O (Dec. 22, 2000)
>Organization:
>Environment:
System: NetBSD pino.my.domain 1.5O NetBSD 1.5O (PINO) #273: Sun Dec 24 00:01:04 JST 2000 itohy@pino.my.domain:/w/src/sys/arch/i386/compile/PINO i386
Architecture: i386
Machine: i386

cbb0 at pci0 dev 19 function 0: Toshiba ToPIC95B CardBus-PCI Bridge (rev. 0x07)
cbb1 at pci0 dev 19 function 1: Toshiba ToPIC95B CardBus-PCI Bridge (rev. 0x07)
cbb0: interrupting at irq 11
cbb0: cacheline 0x0 lattimer 0x0
cbb0: bhlc 0x820000 lscp 0x141400
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 20 device 0 cacheline 0x0, lattimer 0x0
pcmcia0 at cardslot0
cbb1: interrupting at irq 11
cbb1: cacheline 0x0 lattimer 0x0
cbb1: bhlc 0x820000 lscp 0x151500
cardslot1 at cbb1 slot 1 flags 0
cardbus1 at cardslot1: bus 21 device 0 cacheline 0x0, lattimer 0x0
pcmcia1 at cardslot1
	:
ohci0 at cardbus0 dev 0 function 0: Opti RM861HA (rev. 0x10)
ohci0: interrupting at 11
ohci0: OHCI version 1.0, legacy support
usb0 at ohci0: USB revision 1.0
uhub0 at usb0
uhub0: Opti OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
ums0 at uhub0 port 1 configuration 1 interface 0
ums0: vendor 0x05e3 USB Mouse, rev 1.00/1.01, addr 2, iclass 3/1
ums0: 3 buttons and Z dir.
wsmouse1 at ums0 mux 0

>Description:
	Removing CardBus USB card (OHCI) sometimes causes kenel panic.
	One of the reasons of this is probably that the callouts are
	not canceled at detach.
	If callout functions are called after the device is detached,
	the freed softc is refered and this causes any troubles.

>How-To-Repeat:
	Repeat insertion and removal of ohci card several times.

	... sorry I have no crash dumps.

>Fix:
	ENOCLUE
	Cancel callouts in ohci_detach().

>Release-Note:
>Audit-Trail:
>Unformatted: