>Number:         18448
>Category:       kern
>Synopsis:       ohci_device_isoc_close calls ohci_rem_ed twice
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 28 10:31:00 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Takeshi Nakayama
>Release:        NetBSD 1.6
>Organization:
Private
>Environment:
System: NetBSD nyx 1.6 NetBSD 1.6 (NYX32) #39: Fri Sep 27 18:42:10 JST 2002
 takeshi@nyx:/usr/src/sys/arch/sparc64/compile/NYX32 sparc64
Architecture: sparc
Machine: sparc64
>Description:
	In ohci_device_isoc_close(), we call ohci_rem_ed() then
	call ohci_close_pipe(). But ohci_rem_ed() is called from
	ohci_close_pipe(). Therefore, we should not call
	ohci_rem_ed() directly.
>How-To-Repeat:
	code inspection.
>Fix:

Index: ohci.c
===================================================================
RCS file: /cvsroot/syssrc/sys/dev/usb/ohci.c,v
retrieving revision 1.127
diff -u -d -r1.127 ohci.c
--- ohci.c	2002/08/07 20:03:19	1.127
+++ ohci.c	2002/09/16 03:15:56
@@ -3363,13 +3363,8 @@
 {
 	struct ohci_pipe *opipe = (struct ohci_pipe *)pipe;
 	ohci_softc_t *sc = (ohci_softc_t *)pipe->device->bus;
-	int s;
 
 	DPRINTF(("ohci_device_isoc_close: pipe=%p\n", pipe));
-
-	s = splusb();
-	ohci_rem_ed(opipe->sed, sc->sc_isoc_head);
-	splx(s);
 	ohci_close_pipe(pipe, sc->sc_isoc_head);
 #ifdef DIAGNOSTIC
 	opipe->tail.itd->isdone = 1;

>Release-Note:
>Audit-Trail:
>Unformatted: