>Number:         33450
>Category:       kern
>Synopsis:       OHCI_DEBUG code in ohci_softintr() causes infinite loop
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 10 10:16:45 +0000 2006
>Originator:     Ric Yeates
>Release:        HEAD
>Organization:
RadiSys Corp.
>Environment:
Don't have a NetBSD machine, I'm porting code for use in our RTOS.
>Description:
The code snippet:
#ifdef OHCI_DEBUG
	if (ohcidebug > 10) {
		DPRINTF(("ohci_process_done: TD done:\n"));
		ohci_dump_tds(sc, sdone);
	}
#endif

makes use of ohci_dump_tds(), but the TD list pointed to by sdone is linked with the dnext field, so the TD walk can cause an infinite loop or other nasty behavior.
>How-To-Repeat:
Compile USB support with OHCI_DEBUG and set ohcidebug > 10.

>Fix:
I fixed it by using this code:
		for (std = sdone; std; std = std->dnext)
			ohci_dump_td(sc, std);

Likewise for sidone in the next block of OHCI_DEBUG code.