From 51e8c0d6c654c9f139b0f884c33560aa208ee351 Mon Sep 17 00:00:00 2001
From: Andrew Thompson <thompsa@FreeBSD.org>
Date: Tue, 25 Aug 2009 16:59:55 +0000
Subject: [PATCH] It is possible for all the kthreads to exit (hci modules
 unloaded) which in turn ends our usb process. This means the proc pointer
 becomes invalid and will panic if a new kthread is added. Count the number of
 threads and clear the proc pointer on the last one.

Suggested by:	julian
MFC after:	3 days
---
 sys/dev/usb/usb_process.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sys/dev/usb/usb_process.c b/sys/dev/usb/usb_process.c
index 08108853d559..eb503fd18c41 100644
--- a/sys/dev/usb/usb_process.c
+++ b/sys/dev/usb/usb_process.c
@@ -64,6 +64,7 @@
 
 #if (__FreeBSD_version >= 800000)
 static struct proc *usbproc;
+static int usb_pcount;
 #define	USB_THREAD_CREATE(f, s, p, ...) \
 		kproc_kthread_add((f), (s), &usbproc, (p), RFHIGHPID, \
 		    0, "usb", __VA_ARGS__)
@@ -183,6 +184,11 @@ usb_process(void *arg)
 	up->up_ptr = NULL;
 	cv_signal(&up->up_cv);
 	mtx_unlock(up->up_mtx);
+#if (__FreeBSD_version >= 800000)
+	/* Clear the proc pointer if this is the last thread. */
+	if (--usb_pcount == 0)
+		usbproc = NULL;
+#endif
 
 	USB_THREAD_EXIT(0);
 }
@@ -218,6 +224,9 @@ usb_proc_create(struct usb_process *up, struct mtx *p_mtx,
 		up->up_ptr = NULL;
 		goto error;
 	}
+#if (__FreeBSD_version >= 800000)
+	usb_pcount++;
+#endif
 	return (0);
 
 error: