5 files changed, 17 insertions, 11 deletions

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index a962b89b65a6..1e5f529d51a2 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(struct ehci_hcd *ehci)
         int     port = HCS_N_PORTS(ehci->hcs_params);
 
         while (port--) {
-                ehci_writel(ehci, PORT_RWC_BITS,
-                                &ehci->regs->port_status[port]);
                 spin_unlock_irq(&ehci->lock);
                 ehci_port_power(ehci, port, false);
                 spin_lock_irq(&ehci->lock);
+                ehci_writel(ehci, PORT_RWC_BITS,
+                                &ehci->regs->port_status[port]);
         }
 }
 
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index c369c29e496d..2f7690092a7f 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1675,7 +1675,7 @@ max3421_gpout_set_value(struct usb_hcd *hcd, u8 pin_number, u8 value)
         if (pin_number > 7)
                 return;
 
-        mask = 1u << pin_number;
+        mask = 1u << (pin_number % 4);
         idx = pin_number / 4;
 
         if (value)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d61fcc48099e..730b9fd26685 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
 
         ret = 0;
         virt_dev = xhci->devs[slot_id];
+        if (!virt_dev)
+                return -ENODEV;
+
         cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
         if (!cmd) {
                 xhci_dbg(xhci, "Couldn't allocate command structure.\n");
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 4fd041bec332..d7b0f97abbad 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_dev *dev)
                 usb_remove_hcd(xhci->shared_hcd);
                 usb_put_hcd(xhci->shared_hcd);
         }
-        usb_hcd_pci_remove(dev);
 
         /* Workaround for spurious wakeups at shutdown with HSW */
         if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
                 pci_set_power_state(dev, PCI_D3hot);
+
+        usb_hcd_pci_remove(dev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 918e0c739b79..fd9fd12e4861 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1334,12 +1334,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
 
         cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);
 
-        if (cmd->command_trb != xhci->cmd_ring->dequeue) {
-                xhci_err(xhci,
-                         "Command completion event does not match command\n");
-                return;
-        }
-
         del_timer(&xhci->cmd_timer);
 
         trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
@@ -1351,6 +1345,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 xhci_handle_stopped_cmd_ring(xhci, cmd);
                 return;
         }
+
+        if (cmd->command_trb != xhci->cmd_ring->dequeue) {
+                xhci_err(xhci,
+                         "Command completion event does not match command\n");
+                return;
+        }
+
         /*
          * Host aborted the command ring, check if the current command was
          * supposed to be aborted, otherwise continue normally.
@@ -3243,7 +3244,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         send_addr = addr;
 
         /* Queue the TRBs, even if they are zero-length */
-        for (enqd_len = 0; enqd_len < full_len; enqd_len += trb_buff_len) {
+        for (enqd_len = 0; first_trb || enqd_len < full_len;
+                        enqd_len += trb_buff_len) {
                 field = TRB_TYPE(TRB_NORMAL);
 
                 /* TRB buffer should not cross 64KB boundaries */