1 files changed, 7 insertions, 8 deletions

diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 9a1384747f3..7673554fa64 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -375,12 +375,11 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                                  */
                                 if ((token & QTD_STS_XACT) &&
                                                 QTD_CERR(token) == 0 &&
-                                                --qh->xacterrs > 0 &&
+                                                ++qh->xacterrs < QH_XACTERR_MAX &&
                                                 !urb->unlinked) {
                                         ehci_dbg(ehci,
         "detected XactErr len %zu/%zu retry %d\n",
-        qtd->length - QTD_LENGTH(token), qtd->length,
-        QH_XACTERR_MAX - qh->xacterrs);
+        qtd->length - QTD_LENGTH(token), qtd->length, qh->xacterrs);
 
                                         /* reset the token in the qtd and the
                                          * qh overlay (which still contains
@@ -494,7 +493,7 @@ halt:
                 last = qtd;
 
                 /* reinit the xacterr counter for the next qtd */
-                qh->xacterrs = QH_XACTERR_MAX;
+                qh->xacterrs = 0;
         }
 
         /* last urb's completion might still need calling */
@@ -940,7 +939,8 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         head->qh_next.qh = qh;
         head->hw_next = dma;
 
-        qh->xacterrs = QH_XACTERR_MAX;
+        qh_get(qh);
+        qh->xacterrs = 0;
         qh->qh_state = QH_STATE_LINKED;
         /* qtd completions reported later by interrupt */
 }
@@ -1080,7 +1080,7 @@ submit_async (
          * the HC and TT handle it when the TT has a buffer ready.
          */
         if (likely (qh->qh_state == QH_STATE_IDLE))
-                qh_link_async (ehci, qh_get (qh));
+                qh_link_async(ehci, qh);
  done:
         spin_unlock_irqrestore (&ehci->lock, flags);
         if (unlikely (qh == NULL))
@@ -1115,8 +1115,6 @@ static void end_unlink_async (struct ehci_hcd *ehci)
                         && HC_IS_RUNNING (ehci_to_hcd(ehci)->state))
                 qh_link_async (ehci, qh);
         else {
-                qh_put (qh);            // refcount from async list
-
                 /* it's not free to turn the async schedule on/off; leave it
                  * active but idle for a while once it empties.
                  */
@@ -1124,6 +1122,7 @@ static void end_unlink_async (struct ehci_hcd *ehci)
                                 && ehci->async->qh_next.qh == NULL)
                         timer_action (ehci, TIMER_ASYNC_OFF);
         }
+        qh_put(qh);                     /* refcount from async list */
 
         if (next) {
                 ehci->reclaim = NULL;