Re2: usb panic

[Matthew Dillon <dillon@xxxxxxxxxxxxxxxxxxxx>]

    Try this patch.  I only give it a 50-50 chance of working... the 
    timeout I am trying to fix here is known to cause crashes, but the 
    timeout causing your crash could be a different timeout.  There are lots 
    of timeouts in the USB subsystem.

						-Matt

Index: umass/umass.c
===================================================================
RCS file: /cvs/src/sys/dev/usbmisc/umass/umass.c,v
retrieving revision 1.6
diff -u -r1.6 umass.c
--- umass/umass.c	30 Dec 2003 01:01:47 -0000	1.6
+++ umass/umass.c	13 Jan 2004 22:20:44 -0000
@@ -529,6 +529,7 @@
 	struct scsi_sense	cam_scsi_test_unit_ready;
 
 	int			maxlun;			/* maximum LUN number */
+	struct callout_handle	rescan_timeout;
 };
 
 #ifdef USB_DEBUG
@@ -2144,9 +2145,10 @@
 {
 	struct umass_softc *sc = (struct umass_softc *) addr;
 	struct cam_path *path;
-	union ccb *ccb = malloc(sizeof(union ccb), M_USBDEV, M_WAITOK);
+	union ccb *ccb;
 
-	memset(ccb, 0, sizeof(union ccb));
+	sc->rescan_timeout.callout = NULL;
+	ccb = malloc(sizeof(union ccb), M_USBDEV, M_WAITOK|M_ZERO);
 
 	DPRINTF(UDMASS_SCSI, ("scbus%d: scanning for %s:%d:%d:%d\n",
 		cam_sim_path(sc->umass_sim),
@@ -2179,17 +2181,15 @@
 			cam_sim_path(sc->umass_sim));
 
 	if (!cold) {
-		/* Notify CAM of the new device after 1 second delay. Any
+		/* 
+		 * Notify CAM of the new device after 1 second delay. Any
 		 * failure is benign, as the user can still do it by hand
 		 * (camcontrol rescan <busno>). Only do this if we are not
 		 * booting, because CAM does a scan after booting has
 		 * completed, when interrupts have been enabled.
 		 */
-
-		/* XXX This will bomb if the driver is unloaded between attach
-		 * and execution of umass_cam_rescan.
-		 */
-		timeout(umass_cam_rescan, sc, MS_TO_TICKS(200));
+		sc->rescan_timeout =
+			timeout(umass_cam_rescan, sc, MS_TO_TICKS(200));
 	}
 
 	return(0);	/* always succesfull */
@@ -2202,6 +2202,10 @@
 Static int
 umass_cam_detach_sim(struct umass_softc *sc)
 {
+	if (sc->rescan_timeout.callout) {
+		untimeout(umass_cam_rescan, sc, sc->rescan_timeout);
+		sc->rescan_timeout.callout = NULL;
+	}
 	if (sc->umass_sim) {
 		if (xpt_bus_deregister(cam_sim_path(sc->umass_sim)))
 			cam_sim_free(sc->umass_sim, /*free_devq*/TRUE);