3 files changed, 20 insertions, 9 deletions

diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index db7cb8111fbe..106beb194f3c 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -105,7 +105,7 @@ static int ath3k_load_firmware(struct usb_device *udev,
 
         pipe = usb_sndctrlpipe(udev, 0);
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);
         if (!send_buf) {
                 BT_ERR("Can't allocate memory chunk for firmware");
                 return -ENOMEM;
@@ -176,7 +176,7 @@ static int ath3k_load_fwfile(struct usb_device *udev,
 
         count = firmware->size;
 
-        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);
         if (!send_buf) {
                 BT_ERR("Can't allocate memory chunk for firmware");
                 return -ENOMEM;
diff --git a/drivers/bluetooth/bcm203x.c b/drivers/bluetooth/bcm203x.c
index 8b1b643a519b..54952ab800b8 100644
--- a/drivers/bluetooth/bcm203x.c
+++ b/drivers/bluetooth/bcm203x.c
@@ -24,6 +24,7 @@
 
 #include <linux/module.h>
 
+#include <linux/atomic.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -65,6 +66,7 @@ struct bcm203x_data {
         unsigned long           state;
 
         struct work_struct      work;
+        atomic_t                shutdown;
 
         struct urb              *urb;
         unsigned char           *buffer;
@@ -97,6 +99,7 @@ static void bcm203x_complete(struct urb *urb)
 
                 data->state = BCM203X_SELECT_MEMORY;
 
+                /* use workqueue to have a small delay */
                 schedule_work(&data->work);
                 break;
 
@@ -155,7 +158,10 @@ static void bcm203x_work(struct work_struct *work)
         struct bcm203x_data *data =
                 container_of(work, struct bcm203x_data, work);
 
-        if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
+        if (atomic_read(&data->shutdown))
+                return;
+
+        if (usb_submit_urb(data->urb, GFP_KERNEL) < 0)
                 BT_ERR("Can't submit URB");
 }
 
@@ -243,6 +249,7 @@ static int bcm203x_probe(struct usb_interface *intf, const struct usb_device_id
 
         usb_set_intfdata(intf, data);
 
+        /* use workqueue to have a small delay */
         schedule_work(&data->work);
 
         return 0;
@@ -254,6 +261,9 @@ static void bcm203x_disconnect(struct usb_interface *intf)
 
         BT_DBG("intf %p", intf);
 
+        atomic_inc(&data->shutdown);
+        cancel_work_sync(&data->work);
+
         usb_kill_urb(data->urb);
 
         usb_set_intfdata(intf, NULL);
diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 005919ab043c..61b591470a90 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -568,22 +568,23 @@ static int bfusb_load_firmware(struct bfusb_data *data,
 
         BT_INFO("BlueFRITZ! USB loading firmware");
 
+        buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_KERNEL);
+        if (!buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+
         pipe = usb_sndctrlpipe(data->udev, 0);
 
         if (usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION,
                                 0, 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT) < 0) {
                 BT_ERR("Can't change to loading configuration");
+                kfree(buf);
                 return -EBUSY;
         }
 
         data->udev->toggle[0] = data->udev->toggle[1] = 0;
 
-        buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_ATOMIC);
-        if (!buf) {
-                BT_ERR("Can't allocate memory chunk for firmware");
-                return -ENOMEM;
-        }
-
         pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep);
 
         while (count) {