1 files changed, 38 insertions, 9 deletions

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 763f484bc092..3a0f695138f4 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -345,7 +345,8 @@ static void xhci_event_ring_work(unsigned long arg)
         spin_lock_irqsave(&xhci->lock, flags);
         temp = xhci_readl(xhci, &xhci->op_regs->status);
         xhci_dbg(xhci, "op reg status = 0x%x\n", temp);
-        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
+        if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg(xhci, "HW died, polling stopped.\n");
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 return;
@@ -939,8 +940,11 @@ static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
                 return 0;
         }
 
+        xhci = hcd_to_xhci(hcd);
+        if (xhci->xhc_state & XHCI_STATE_HALTED)
+                return -ENODEV;
+
         if (check_virt_dev) {
-                xhci = hcd_to_xhci(hcd);
                 if (!udev->slot_id || !xhci->devs
                         || !xhci->devs[udev->slot_id]) {
                         printk(KERN_DEBUG "xHCI %s called with unaddressed "
@@ -1081,8 +1085,11 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                 if (urb->dev->speed == USB_SPEED_FULL) {
                         ret = xhci_check_maxpacket(xhci, slot_id,
                                         ep_index, urb);
-                        if (ret < 0)
+                        if (ret < 0) {
+                                xhci_urb_free_priv(xhci, urb_priv);
+                                urb->hcpriv = NULL;
                                 return ret;
+                        }
                 }
 
                 /* We have a spinlock and interrupts disabled, so we must pass
@@ -1093,6 +1100,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                         goto dying;
                 ret = xhci_queue_ctrl_tx(xhci, GFP_ATOMIC, urb,
                                 slot_id, ep_index);
+                if (ret)
+                        goto free_priv;
                 spin_unlock_irqrestore(&xhci->lock, flags);
         } else if (usb_endpoint_xfer_bulk(&urb->ep->desc)) {
                 spin_lock_irqsave(&xhci->lock, flags);
@@ -1113,6 +1122,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                         ret = xhci_queue_bulk_tx(xhci, GFP_ATOMIC, urb,
                                         slot_id, ep_index);
                 }
+                if (ret)
+                        goto free_priv;
                 spin_unlock_irqrestore(&xhci->lock, flags);
         } else if (usb_endpoint_xfer_int(&urb->ep->desc)) {
                 spin_lock_irqsave(&xhci->lock, flags);
@@ -1120,6 +1131,8 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                         goto dying;
                 ret = xhci_queue_intr_tx(xhci, GFP_ATOMIC, urb,
                                 slot_id, ep_index);
+                if (ret)
+                        goto free_priv;
                 spin_unlock_irqrestore(&xhci->lock, flags);
         } else {
                 spin_lock_irqsave(&xhci->lock, flags);
@@ -1127,18 +1140,22 @@ int xhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flags)
                         goto dying;
                 ret = xhci_queue_isoc_tx_prepare(xhci, GFP_ATOMIC, urb,
                                 slot_id, ep_index);
+                if (ret)
+                        goto free_priv;
                 spin_unlock_irqrestore(&xhci->lock, flags);
         }
 exit:
         return ret;
 dying:
-        xhci_urb_free_priv(xhci, urb_priv);
-        urb->hcpriv = NULL;
         xhci_dbg(xhci, "Ep 0x%x: URB %p submitted for "
                         "non-responsive xHCI host.\n",
                         urb->ep->desc.bEndpointAddress, urb);
+        ret = -ESHUTDOWN;
+free_priv:
+        xhci_urb_free_priv(xhci, urb_priv);
+        urb->hcpriv = NULL;
         spin_unlock_irqrestore(&xhci->lock, flags);
-        return -ESHUTDOWN;
+        return ret;
 }
 
 /* Get the right ring for the given URB.
@@ -1235,6 +1252,13 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         if (temp == 0xffffffff || (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg(xhci, "HW died, freeing TD.\n");
                 urb_priv = urb->hcpriv;
+                for (i = urb_priv->td_cnt; i < urb_priv->length; i++) {
+                        td = urb_priv->td[i];
+                        if (!list_empty(&td->td_list))
+                                list_del_init(&td->td_list);
+                        if (!list_empty(&td->cancelled_td_list))
+                                list_del_init(&td->cancelled_td_list);
+                }
 
                 usb_hcd_unlink_urb_from_ep(hcd, urb);
                 spin_unlock_irqrestore(&xhci->lock, flags);
@@ -1242,7 +1266,8 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 xhci_urb_free_priv(xhci, urb_priv);
                 return ret;
         }
-        if (xhci->xhc_state & XHCI_STATE_DYING) {
+        if ((xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_dbg(xhci, "Ep 0x%x: URB %p to be canceled on "
                                 "non-responsive xHCI host.\n",
                                 urb->ep->desc.bEndpointAddress, urb);
@@ -2665,7 +2690,10 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         int i, ret;
 
         ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
-        if (ret <= 0)
+        /* If the host is halted due to driver unload, we still need to free the
+         * device.
+         */
+        if (ret <= 0 && ret != -ENODEV)
                 return;
 
         virt_dev = xhci->devs[udev->slot_id];
@@ -2679,7 +2707,8 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
         spin_lock_irqsave(&xhci->lock, flags);
         /* Don't disable the slot if the host controller is dead. */
         state = xhci_readl(xhci, &xhci->op_regs->status);
-        if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING)) {
+        if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
+                        (xhci->xhc_state & XHCI_STATE_HALTED)) {
                 xhci_free_virt_device(xhci, udev->slot_id);
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 return;