race condition in ehci/USB code..

[Julian Elischer]

I just found a case where the ehci hardware is writing data back into a 
buffer
that has been put back on the free list.
I assume that there was a timeout on the command, but the trasaction was 
never
cancelled.. (or we a re part way through cancelling it).

Ian, was this fixed in your timeout changes you just reverted?
Does anyone else have any domain knowldge on this stuff?