2 files changed, 8 insertions, 5 deletions

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index c962608b4b9a..26678cadfb21 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -123,10 +123,11 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
         }
 
         if (usb_endpoint_xfer_isoc(&ep->desc))
-                max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1) *
-                        (desc->bmAttributes + 1);
+                max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
+                        le16_to_cpu(ep->desc.wMaxPacketSize);
         else if (usb_endpoint_xfer_int(&ep->desc))
-                max_tx = ep->desc.wMaxPacketSize * (desc->bMaxBurst + 1);
+                max_tx = le16_to_cpu(ep->desc.wMaxPacketSize) *
+                        (desc->bMaxBurst + 1);
         else
                 max_tx = 999999;
         if (le16_to_cpu(desc->wBytesPerInterval) > max_tx) {
@@ -134,10 +135,10 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                                 "config %d interface %d altsetting %d ep %d: "
                                 "setting to %d\n",
                                 usb_endpoint_xfer_isoc(&ep->desc) ? "Isoc" : "Int",
-                                desc->wBytesPerInterval,
+                                le16_to_cpu(desc->wBytesPerInterval),
                                 cfgno, inum, asnum, ep->desc.bEndpointAddress,
                                 max_tx);
-                ep->ss_ep_comp.wBytesPerInterval = max_tx;
+                ep->ss_ep_comp.wBytesPerInterval = cpu_to_le16(max_tx);
         }
 }
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 8669ba3fe794..73cbbd85219f 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1775,6 +1775,8 @@ int usb_hcd_alloc_bandwidth(struct usb_device *udev,
                 struct usb_interface *iface = usb_ifnum_to_if(udev,
                                 cur_alt->desc.bInterfaceNumber);
 
+                if (!iface)
+                        return -EINVAL;
                 if (iface->resetting_device) {
                         /*
                          * The USB core just reset the device, so the xHCI host