commit 2efb2c7ddfa29759c063bbedbc09c2ba96b01e2f
Author: Ryota Ozaki <ozaki-r@iij.ad.jp>
Date:   Mon Nov 17 12:47:18 2014 +0900

    Replace callout_stop with callout_halt
    
    These need some rearrangements.

diff --git a/sys/dev/sysmon/sysmon_envsys_events.c b/sys/dev/sysmon/sysmon_envsys_events.c
index e479bd6..38c5914 100644
--- a/sys/dev/sysmon/sysmon_envsys_events.c
+++ b/sys/dev/sysmon/sysmon_envsys_events.c
@@ -566,7 +566,6 @@ sme_events_init(struct sysmon_envsys *sme)
 	if (error)
 		return error;
 
-	mutex_init(&sme->sme_callout_mtx, MUTEX_DEFAULT, IPL_SOFTCLOCK);
 	callout_init(&sme->sme_callout, CALLOUT_MPSAFE);
 	callout_setfunc(&sme->sme_callout, sme_events_check, sme);
 	sme->sme_flags |= SME_CALLOUT_INITIALIZED;
@@ -612,11 +611,16 @@ sme_events_destroy(struct sysmon_envsys *sme)
 {
 	KASSERT(mutex_owned(&sme->sme_mtx));
 
-	callout_stop(&sme->sme_callout);
-	workqueue_destroy(sme->sme_wq);
-	mutex_destroy(&sme->sme_callout_mtx);
-	callout_destroy(&sme->sme_callout);
+	/*
+	 * Unset before callout_halt to ensure callout is not scheduled again
+	 * during callout_halt.
+	 */
 	sme->sme_flags &= ~SME_CALLOUT_INITIALIZED;
+
+	callout_halt(&sme->sme_callout, &sme->sme_mtx);
+	callout_destroy(&sme->sme_callout);
+
+	workqueue_destroy(sme->sme_wq);
 	DPRINTF(("%s: events framework destroyed for '%s'\n",
 	    __func__, sme->sme_name));
 }
@@ -708,14 +712,14 @@ sme_events_check(void *arg)
 
 	KASSERT(sme != NULL);
 
-	mutex_enter(&sme->sme_callout_mtx);
+	mutex_enter(&sme->sme_mtx);
 	LIST_FOREACH(see, &sme->sme_events_list, see_list) {
 		workqueue_enqueue(sme->sme_wq, &see->see_wk, NULL);
 		see->see_edata->flags |= ENVSYS_FNEED_REFRESH;
 	}
 	if (!sysmon_low_power)
 		sme_schedule_callout(sme);
-	mutex_exit(&sme->sme_callout_mtx);
+	mutex_exit(&sme->sme_mtx);
 }
 
 /*
diff --git a/sys/dev/sysmon/sysmonvar.h b/sys/dev/sysmon/sysmonvar.h
index 4085a1e..97e3b97 100644
--- a/sys/dev/sysmon/sysmonvar.h
+++ b/sys/dev/sysmon/sysmonvar.h
@@ -208,7 +208,6 @@ struct sysmon_envsys {
 	 * Locking/synchronization.
 	 */
 	kmutex_t sme_mtx;
-	kmutex_t sme_callout_mtx;
 	kcondvar_t sme_condvar;
 };
 
diff --git a/sys/dev/usb/ohci.c b/sys/dev/usb/ohci.c
index faef3f3..0888423 100644
--- a/sys/dev/usb/ohci.c
+++ b/sys/dev/usb/ohci.c
@@ -350,7 +350,7 @@ ohci_detach(struct ohci_softc *sc, int flags)
 	if (rv != 0)
 		return (rv);
 
-	callout_stop(&sc->sc_tmo_rhsc);
+	callout_halt(&sc->sc_tmo_rhsc, &sc->sc_lock);
 
 	usb_delay_ms(&sc->sc_bus, 300); /* XXX let stray task complete */
 	callout_destroy(&sc->sc_tmo_rhsc);
diff --git a/sys/kern/kern_ktrace.c b/sys/kern/kern_ktrace.c
index ea6de7c..25b2a3e 100644
--- a/sys/kern/kern_ktrace.c
+++ b/sys/kern/kern_ktrace.c
@@ -1402,6 +1402,9 @@ ktrace_thread(void *arg)
 	}
 
 	TAILQ_REMOVE(&ktdq, ktd, ktd_list);
+
+	callout_halt(&ktd->ktd_wakch, &ktrace_lock);
+	callout_destroy(&ktd->ktd_wakch);
 	mutex_exit(&ktrace_lock);
 
 	/*
@@ -1415,8 +1418,6 @@ ktrace_thread(void *arg)
 	cv_destroy(&ktd->ktd_sync_cv);
 	cv_destroy(&ktd->ktd_cv);
 
-	callout_stop(&ktd->ktd_wakch);
-	callout_destroy(&ktd->ktd_wakch);
 	kmem_free(ktd, sizeof(*ktd));
 
 	kthread_exit(0);