[Bluetooth] Fix wrong URB handling of btusb driver

The btusb driver contains two typos that result in some buggy behavior,
but the impact is not immediately visible.

During initialization the submitting of interrupt URBs might fail and
then make sure to remove the correct flag and not one of the hci_dev
flags.

When closing down the interface make sure to kill the anchor for the
ISOC URBs and not kill the interrupt URBs twice.

Also cancel any scheduled work when closing down the interface.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 4 insertions, 2 deletions

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7665347238c7..b4756a6a3a68 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -519,7 +519,7 @@ static int btusb_open(struct hci_dev *hdev)
 
         err = btusb_submit_intr_urb(hdev);
         if (err < 0) {
-                clear_bit(BTUSB_INTR_RUNNING, &hdev->flags);
+                clear_bit(BTUSB_INTR_RUNNING, &data->flags);
                 clear_bit(HCI_RUNNING, &hdev->flags);
         }
 
@@ -535,8 +535,10 @@ static int btusb_close(struct hci_dev *hdev)
         if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
                 return 0;
 
+        cancel_work_sync(&data->work);
+
         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
-        usb_kill_anchored_urbs(&data->intr_anchor);
+        usb_kill_anchored_urbs(&data->isoc_anchor);
 
         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
         usb_kill_anchored_urbs(&data->bulk_anchor);