10 files changed, 263 insertions, 137 deletions
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 35cdba10411b..db00492588b6 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -719,7 +719,6 @@ dead:
 */
 static int ehci_urb_enqueue (
        struct usb_hcd  *hcd,
-        struct usb_host_endpoint *ep,
        struct urb      *urb,
        gfp_t           mem_flags
 ) {
@@ -734,12 +733,12 @@ static int ehci_urb_enqueue (
        default:
                if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags))
                        return -ENOMEM;
-                return submit_async (ehci, ep, urb, &qtd_list, mem_flags);
+                return submit_async(ehci, urb, &qtd_list, mem_flags);
        case PIPE_INTERRUPT:
                if (!qh_urb_transaction (ehci, urb, &qtd_list, mem_flags))
                        return -ENOMEM;
-                return intr_submit (ehci, ep, urb, &qtd_list, mem_flags);
+                return intr_submit(ehci, urb, &qtd_list, mem_flags);
        case PIPE_ISOCHRONOUS:
                if (urb->dev->speed == USB_SPEED_HIGH)
@@ -777,13 +776,18 @@ static void unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
 * completions normally happen asynchronously
 */
-static int ehci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
+static int ehci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct ehci_hcd         *ehci = hcd_to_ehci (hcd);
        struct ehci_qh          *qh;
        unsigned long           flags;
+        int                     rc;
        spin_lock_irqsave (&ehci->lock, flags);
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc)
+                goto done;
        switch (usb_pipetype (urb->pipe)) {
        // case PIPE_CONTROL:
        // case PIPE_BULK:
@@ -838,7 +842,7 @@ static int ehci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
        }
 done:
        spin_unlock_irqrestore (&ehci->lock, flags);
-        return 0;
+        return rc;
 }
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 140bfa423e07..1da2de4d34ed 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -262,6 +262,7 @@ __acquires(ehci->lock)
 #endif
        /* complete() can reenter this HCD */
+        usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
        spin_unlock (&ehci->lock);
        usb_hcd_giveback_urb (ehci_to_hcd(ehci), urb);
        spin_lock (&ehci->lock);
@@ -913,7 +914,6 @@ static struct ehci_qh *qh_append_tds (
 static int
 submit_async (
        struct ehci_hcd         *ehci,
-        struct usb_host_endpoint *ep,
        struct urb              *urb,
        struct list_head        *qtd_list,
        gfp_t                   mem_flags
@@ -922,10 +922,10 @@ submit_async (
        int                     epnum;
        unsigned long           flags;
        struct ehci_qh          *qh = NULL;
-        int                     rc = 0;
+        int                     rc;
        qtd = list_entry (qtd_list->next, struct ehci_qtd, qtd_list);
-        epnum = ep->desc.bEndpointAddress;
+        epnum = urb->ep->desc.bEndpointAddress;
 #ifdef EHCI_URB_TRACE
        ehci_dbg (ehci,
@@ -933,7 +933,7 @@ submit_async (
                __FUNCTION__, urb->dev->devpath, urb,
                epnum & 0x0f, (epnum & USB_DIR_IN) ? "in" : "out",
                urb->transfer_buffer_length,
-                qtd, ep->hcpriv);
+                qtd, urb->ep->hcpriv);
 #endif
        spin_lock_irqsave (&ehci->lock, flags);
@@ -942,9 +942,13 @@ submit_async (
                rc = -ESHUTDOWN;
                goto done;
        }
+        rc = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
+        if (unlikely(rc))
+                goto done;
-        qh = qh_append_tds (ehci, urb, qtd_list, epnum, &ep->hcpriv);
+        qh = qh_append_tds(ehci, urb, qtd_list, epnum, &urb->ep->hcpriv);
        if (unlikely(qh == NULL)) {
+                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
                rc = -ENOMEM;
                goto done;
        }
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index e682f2342ef8..8b267b3fd2bb 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -797,7 +797,6 @@ done:
 static int intr_submit (
        struct ehci_hcd         *ehci,
-        struct usb_host_endpoint *ep,
        struct urb              *urb,
        struct list_head        *qtd_list,
        gfp_t                   mem_flags
@@ -805,23 +804,26 @@ static int intr_submit (
        unsigned                epnum;
        unsigned long           flags;
        struct ehci_qh          *qh;
-        int                     status = 0;
+        int                     status;
        struct list_head        empty;
        /* get endpoint and transfer/schedule data */
-        epnum = ep->desc.bEndpointAddress;
+        epnum = urb->ep->desc.bEndpointAddress;
        spin_lock_irqsave (&ehci->lock, flags);
        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
                        &ehci_to_hcd(ehci)->flags))) {
                status = -ESHUTDOWN;
-                goto done;
+                goto done_not_linked;
        }
+        status = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
+        if (unlikely(status))
+                goto done_not_linked;
        /* get qh and force any scheduling errors */
        INIT_LIST_HEAD (&empty);
-        qh = qh_append_tds (ehci, urb, &empty, epnum, &ep->hcpriv);
+        qh = qh_append_tds(ehci, urb, &empty, epnum, &urb->ep->hcpriv);
        if (qh == NULL) {
                status = -ENOMEM;
                goto done;
@@ -832,13 +834,16 @@ static int intr_submit (
        }
        /* then queue the urb's tds to the qh */
-        qh = qh_append_tds (ehci, urb, qtd_list, epnum, &ep->hcpriv);
+        qh = qh_append_tds(ehci, urb, qtd_list, epnum, &urb->ep->hcpriv);
        BUG_ON (qh == NULL);
        /* ... update usbfs periodic stats */
        ehci_to_hcd(ehci)->self.bandwidth_int_reqs++;
 done:
+        if (unlikely(status))
+                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+done_not_linked:
        spin_unlock_irqrestore (&ehci->lock, flags);
        if (status)
                qtd_list_free (ehci, urb, qtd_list);
@@ -1686,12 +1691,19 @@ static int itd_submit (struct ehci_hcd *ehci, struct urb *urb,
        /* schedule ... need to lock */
        spin_lock_irqsave (&ehci->lock, flags);
        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &ehci_to_hcd(ehci)->flags)))
+                               &ehci_to_hcd(ehci)->flags))) {
                status = -ESHUTDOWN;
-        else
+                goto done_not_linked;
-                status = iso_stream_schedule (ehci, urb, stream);
+        }
+        status = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
+        if (unlikely(status))
+                goto done_not_linked;
+        status = iso_stream_schedule(ehci, urb, stream);
        if (likely (status == 0))
                itd_link_urb (ehci, urb, ehci->periodic_size << 3, stream);
+        else
+                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+done_not_linked:
        spin_unlock_irqrestore (&ehci->lock, flags);
 done:
@@ -2049,12 +2061,19 @@ static int sitd_submit (struct ehci_hcd *ehci, struct urb *urb,
        /* schedule ... need to lock */
        spin_lock_irqsave (&ehci->lock, flags);
        if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,
-                               &ehci_to_hcd(ehci)->flags)))
+                               &ehci_to_hcd(ehci)->flags))) {
                status = -ESHUTDOWN;
-        else
+                goto done_not_linked;
-                status = iso_stream_schedule (ehci, urb, stream);
+        }
+        status = usb_hcd_link_urb_to_ep(ehci_to_hcd(ehci), urb);
+        if (unlikely(status))
+                goto done_not_linked;
+        status = iso_stream_schedule(ehci, urb, stream);
        if (status == 0)
                sitd_link_urb (ehci, urb, ehci->periodic_size << 3, stream);
+        else
+                usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
+done_not_linked:
        spin_unlock_irqrestore (&ehci->lock, flags);
 done:
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index 5c851a36de72..d5027dc75a57 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -290,6 +290,7 @@ __releases(isp116x->lock) __acquires(isp116x->lock)
        urb_dbg(urb, "Finish");
+        usb_hcd_unlink_urb_from_ep(isp116x_to_hcd(isp116x), urb);
        spin_unlock(&isp116x->lock);
        usb_hcd_giveback_urb(isp116x_to_hcd(isp116x), urb);
        spin_lock(&isp116x->lock);
@@ -673,7 +674,7 @@ static int balance(struct isp116x *isp116x, u16 period, u16 load)
 /*-----------------------------------------------------------------*/
 static int isp116x_urb_enqueue(struct usb_hcd *hcd,
-                               struct usb_host_endpoint *hep, struct urb *urb,
+                               struct urb *urb,
                               gfp_t mem_flags)
 {
        struct isp116x *isp116x = hcd_to_isp116x(hcd);
@@ -682,6 +683,7 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
        int is_out = !usb_pipein(pipe);
        int type = usb_pipetype(pipe);
        int epnum = usb_pipeendpoint(pipe);
+        struct usb_host_endpoint *hep = urb->ep;
        struct isp116x_ep *ep = NULL;
        unsigned long flags;
        int i;
@@ -705,7 +707,12 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
        if (!HC_IS_RUNNING(hcd->state)) {
                kfree(ep);
                ret = -ENODEV;
-                goto fail;
+                goto fail_not_linked;
+        }
+        ret = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (ret) {
+                kfree(ep);
+                goto fail_not_linked;
        }
        if (hep->hcpriv)
@@ -818,6 +825,9 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
        start_atl_transfers(isp116x);
      fail:
+        if (ret)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+      fail_not_linked:
        spin_unlock_irqrestore(&isp116x->lock, flags);
        return ret;
 }
@@ -825,20 +835,21 @@ static int isp116x_urb_enqueue(struct usb_hcd *hcd,
 /*
   Dequeue URBs.
 */
-static int isp116x_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int isp116x_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
+                int status)
 {
        struct isp116x *isp116x = hcd_to_isp116x(hcd);
        struct usb_host_endpoint *hep;
        struct isp116x_ep *ep, *ep_act;
        unsigned long flags;
+        int rc;
        spin_lock_irqsave(&isp116x->lock, flags);
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc)
+                goto done;
        hep = urb->hcpriv;
-        /* URB already unlinked (or never linked)? */
-        if (!hep) {
-                spin_unlock_irqrestore(&isp116x->lock, flags);
-                return 0;
-        }
        ep = hep->hcpriv;
        WARN_ON(hep != ep->hep);
@@ -856,9 +867,9 @@ static int isp116x_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
        if (urb)
                finish_request(isp116x, ep, urb);
+ done:
        spin_unlock_irqrestore(&isp116x->lock, flags);
-        return 0;
+        return rc;
 }
 static void isp116x_endpoint_disable(struct usb_hcd *hcd,
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index d673cb9c36b1..6b06ab69938f 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -117,7 +117,6 @@ MODULE_PARM_DESC (no_handshake, "true (not default) disables BIOS handshake");
 */
 static int ohci_urb_enqueue (
        struct usb_hcd  *hcd,
-        struct usb_host_endpoint *ep,
        struct urb      *urb,
        gfp_t           mem_flags
 ) {
@@ -134,7 +133,7 @@ static int ohci_urb_enqueue (
 #endif
        /* every endpoint has a ed, locate and maybe (re)initialize it */
-        if (! (ed = ed_get (ohci, ep, urb->dev, pipe, urb->interval)))
+        if (! (ed = ed_get (ohci, urb->ep, urb->dev, pipe, urb->interval)))
                return -ENOMEM;
        /* for the private part of the URB we need the number of TDs (size) */
@@ -199,22 +198,17 @@ static int ohci_urb_enqueue (
                retval = -ENODEV;
                goto fail;
        }
+        retval = usb_hcd_link_urb_to_ep(hcd, urb);
-        /* in case of unlink-during-submit */
+        if (retval)
-        spin_lock (&urb->lock);
-        if (urb->status != -EINPROGRESS) {
-                spin_unlock (&urb->lock);
-                urb->hcpriv = urb_priv;
-                finish_urb (ohci, urb);
-                retval = 0;
                goto fail;
-        }
        /* schedule the ed if needed */
        if (ed->state == ED_IDLE) {
                retval = ed_schedule (ohci, ed);
-                if (retval < 0)
+                if (retval < 0) {
-                        goto fail0;
+                        usb_hcd_unlink_urb_from_ep(hcd, urb);
+                        goto fail;
+                }
                if (ed->type == PIPE_ISOCHRONOUS) {
                        u16     frame = ohci_frame_no(ohci);
@@ -238,8 +232,6 @@ static int ohci_urb_enqueue (
        urb->hcpriv = urb_priv;
        td_submit_urb (ohci, urb);
-fail0:
-        spin_unlock (&urb->lock);
 fail:
        if (retval)
                urb_free_priv (ohci, urb_priv);
@@ -253,17 +245,21 @@ fail:
 * asynchronously, and we might be dealing with an urb that's
 * partially transferred, or an ED with other urbs being unlinked.
 */
-static int ohci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
+static int ohci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct ohci_hcd         *ohci = hcd_to_ohci (hcd);
        unsigned long           flags;
+        int                     rc;
 #ifdef OHCI_VERBOSE_DEBUG
        urb_print (urb, "UNLINK", 1);
 #endif
        spin_lock_irqsave (&ohci->lock, flags);
-        if (HC_IS_RUNNING(hcd->state)) {
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc) {
+                ;       /* Do nothing */
+        } else if (HC_IS_RUNNING(hcd->state)) {
                urb_priv_t  *urb_priv;
                /* Unless an IRQ completed the unlink while it was being
@@ -284,7 +280,7 @@ static int ohci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
                        finish_urb (ohci, urb);
        }
        spin_unlock_irqrestore (&ohci->lock, flags);
-        return 0;
+        return rc;
 }
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
index 547d39be3eb9..889c0720743b 100644
--- a/drivers/usb/host/ohci-q.c
+++ b/drivers/usb/host/ohci-q.c
@@ -74,6 +74,7 @@ __acquires(ohci->lock)
 #endif
        /* urb->complete() can reenter this HCD */
+        usb_hcd_unlink_urb_from_ep(ohci_to_hcd(ohci), urb);
        spin_unlock (&ohci->lock);
        usb_hcd_giveback_urb (ohci_to_hcd(ohci), urb);
        spin_lock (&ohci->lock);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 40a1de4c256e..94bb229df3bc 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -784,6 +784,9 @@ static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
                if (urb) {
                        urb->status = -ENODEV;
                        urb->hcpriv = NULL;
+                        usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597),
+                                        urb);
                        spin_unlock(&r8a66597->lock);
                        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb);
                        spin_lock(&r8a66597->lock);
@@ -1131,6 +1134,8 @@ static void done(struct r8a66597 *r8a66597, struct r8a66597_td *td,
                        urb->start_frame = r8a66597_get_frame(hcd);
                urb->hcpriv = NULL;
+                usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
                spin_unlock(&r8a66597->lock);
                usb_hcd_giveback_urb(hcd, urb);
                spin_lock(&r8a66597->lock);
@@ -1722,21 +1727,25 @@ static struct r8a66597_td *r8a66597_make_td(struct r8a66597 *r8a66597,
 }
 static int r8a66597_urb_enqueue(struct usb_hcd *hcd,
-                                struct usb_host_endpoint *hep,
                                struct urb *urb,
                                gfp_t mem_flags)
 {
+        struct usb_host_endpoint *hep = urb->ep;
        struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
        struct r8a66597_td *td = NULL;
-        int ret = 0, request = 0;
+        int ret, request = 0;
        unsigned long flags;
        spin_lock_irqsave(&r8a66597->lock, flags);
        if (!get_urb_to_r8a66597_dev(r8a66597, urb)) {
                ret = -ENODEV;
-                goto error;
+                goto error_not_linked;
        }
+        ret = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (ret)
+                goto error_not_linked;
        if (!hep->hcpriv) {
                hep->hcpriv = kzalloc(sizeof(struct r8a66597_pipe),
                                GFP_ATOMIC);
@@ -1761,15 +1770,7 @@ static int r8a66597_urb_enqueue(struct usb_hcd *hcd,
        if (list_empty(&r8a66597->pipe_queue[td->pipenum]))
                request = 1;
        list_add_tail(&td->queue, &r8a66597->pipe_queue[td->pipenum]);
-        spin_lock(&urb->lock);
-        if (urb->status != -EINPROGRESS) {
-                spin_unlock(&urb->lock);
-                ret = -EPIPE;
-                goto error;
-        }
        urb->hcpriv = td;
-        spin_unlock(&urb->lock);
        if (request) {
                ret = start_transfer(r8a66597, td);
@@ -1781,17 +1782,26 @@ static int r8a66597_urb_enqueue(struct usb_hcd *hcd,
                set_td_timer(r8a66597, td);
 error:
+        if (ret)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+error_not_linked:
        spin_unlock_irqrestore(&r8a66597->lock, flags);
        return ret;
 }
-static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb,
+                int status)
 {
        struct r8a66597 *r8a66597 = hcd_to_r8a66597(hcd);
        struct r8a66597_td *td;
        unsigned long flags;
+        int rc;
        spin_lock_irqsave(&r8a66597->lock, flags);
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
+        if (rc)
+                goto done;
        if (urb->hcpriv) {
                td = urb->hcpriv;
                pipe_stop(r8a66597, td->pipe);
@@ -1799,8 +1809,9 @@ static int r8a66597_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
                disable_irq_empty(r8a66597, td->pipenum);
                done(r8a66597, td, td->pipenum, urb);
        }
+ done:
        spin_unlock_irqrestore(&r8a66597->lock, flags);
-        return 0;
+        return rc;
 }
 static void r8a66597_endpoint_disable(struct usb_hcd *hcd,
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index 4cfa3ff2c993..3d3a63d002c5 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -441,6 +441,7 @@ static void finish_request(
        urb->hcpriv = NULL;
        spin_unlock(&urb->lock);
+        usb_hcd_unlink_urb_from_ep(sl811_to_hcd(sl811), urb);
        spin_unlock(&sl811->lock);
        usb_hcd_giveback_urb(sl811_to_hcd(sl811), urb);
        spin_lock(&sl811->lock);
@@ -807,7 +808,6 @@ static int balance(struct sl811 *sl811, u16 period, u16 load)
 static int sl811h_urb_enqueue(
        struct usb_hcd          *hcd,
-        struct usb_host_endpoint *hep,
        struct urb              *urb,
        gfp_t                   mem_flags
 ) {
@@ -820,7 +820,8 @@ static int sl811h_urb_enqueue(
        struct sl811h_ep        *ep = NULL;
        unsigned long           flags;
        int                     i;
-        int                     retval = 0;
+        int                     retval;
+        struct usb_host_endpoint        *hep = urb->ep;
 #ifdef  DISABLE_ISO
        if (type == PIPE_ISOCHRONOUS)
@@ -838,7 +839,12 @@ static int sl811h_urb_enqueue(
                        || !HC_IS_RUNNING(hcd->state)) {
                retval = -ENODEV;
                kfree(ep);
-                goto fail;
+                goto fail_not_linked;
+        }
+        retval = usb_hcd_link_urb_to_ep(hcd, urb);
+        if (retval) {
+                kfree(ep);
+                goto fail_not_linked;
        }
        if (hep->hcpriv) {
@@ -965,23 +971,27 @@ static int sl811h_urb_enqueue(
        start_transfer(sl811);
        sl811_write(sl811, SL11H_IRQ_ENABLE, sl811->irq_enable);
 fail:
+        if (retval)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+fail_not_linked:
        spin_unlock_irqrestore(&sl811->lock, flags);
        return retval;
 }
-static int sl811h_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int sl811h_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct sl811            *sl811 = hcd_to_sl811(hcd);
        struct usb_host_endpoint *hep;
        unsigned long           flags;
        struct sl811h_ep        *ep;
-        int                     retval = 0;
+        int                     retval;
        spin_lock_irqsave(&sl811->lock, flags);
-        hep = urb->hcpriv;
+        retval = usb_hcd_check_unlink_urb(hcd, urb, status);
-        if (!hep)
+        if (retval)
                goto fail;
+        hep = urb->hcpriv;
        ep = hep->hcpriv;
        if (ep) {
                /* finish right away if this urb can't be active ...
@@ -1029,8 +1039,8 @@ static int sl811h_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
                        VDBG("dequeue, urb %p active %s; wait4irq\n", urb,
                                (sl811->active_a == ep) ? "A" : "B");
        } else
-fail:
                retval = -EINVAL;
+ fail:
        spin_unlock_irqrestore(&sl811->lock, flags);
        return retval;
 }
diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c
index 598ad098aeeb..c87660b5edc3 100644
--- a/drivers/usb/host/u132-hcd.c
+++ b/drivers/usb/host/u132-hcd.c
@@ -521,6 +521,7 @@ static void u132_hcd_giveback_urb(struct u132 *u132, struct u132_endp *endp,
        urb->status = status;
        urb->hcpriv = NULL;
        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
        endp->queue_next += 1;
        if (ENDP_QUEUE_SIZE > --endp->queue_size) {
                endp->active = 0;
@@ -561,6 +562,7 @@ static void u132_hcd_abandon_urb(struct u132 *u132, struct u132_endp *endp,
        urb->status = status;
        urb->hcpriv = NULL;
        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        usb_hcd_unlink_urb_from_ep(hcd, urb);
        endp->queue_next += 1;
        if (ENDP_QUEUE_SIZE > --endp->queue_size) {
                endp->active = 0;
@@ -1876,20 +1878,32 @@ static int u132_hcd_reset(struct usb_hcd *hcd)
 }
 static int create_endpoint_and_queue_int(struct u132 *u132,
-        struct u132_udev *udev, struct usb_host_endpoint *hep, struct urb *urb,
+        struct u132_udev *udev, struct urb *urb,
        struct usb_device *usb_dev, u8 usb_addr, u8 usb_endp, u8 address,
        gfp_t mem_flags)
 {
        struct u132_ring *ring;
        unsigned long irqs;
-        u8 endp_number = ++u132->num_endpoints;
+        int rc;
-        struct u132_endp *endp = hep->hcpriv = u132->endp[endp_number - 1] =
+        u8 endp_number;
-                kmalloc(sizeof(struct u132_endp), mem_flags);
+        struct u132_endp *endp = kmalloc(sizeof(struct u132_endp), mem_flags);
        if (!endp) {
                return -ENOMEM;
        }
+        spin_lock_init(&endp->queue_lock.slock);
+        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        rc = usb_hcd_link_urb_to_ep(u132_to_hcd(u132), urb);
+        if (rc) {
+                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
+                kfree(endp);
+                return rc;
+        }
+        endp_number = ++u132->num_endpoints;
+        urb->ep->hcpriv = u132->endp[endp_number - 1] = endp;
        INIT_DELAYED_WORK(&endp->scheduler, u132_hcd_endp_work_scheduler);
-        spin_lock_init(&endp->queue_lock.slock);
        INIT_LIST_HEAD(&endp->urb_more);
        ring = endp->ring = &u132->ring[0];
        if (ring->curr_endp) {
@@ -1905,7 +1919,7 @@ static int create_endpoint_and_queue_int(struct u132 *u132,
        endp->delayed = 0;
        endp->endp_number = endp_number;
        endp->u132 = u132;
-        endp->hep = hep;
+        endp->hep = urb->ep;
        endp->pipetype = usb_pipetype(urb->pipe);
        u132_endp_init_kref(u132, endp);
        if (usb_pipein(urb->pipe)) {
@@ -1924,7 +1938,6 @@ static int create_endpoint_and_queue_int(struct u132 *u132,
                u132_udev_get_kref(u132, udev);
        }
        urb->hcpriv = u132;
-        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
        endp->delayed = 1;
        endp->jiffies = jiffies + msecs_to_jiffies(urb->interval);
        endp->udev_number = address;
@@ -1939,8 +1952,8 @@ static int create_endpoint_and_queue_int(struct u132 *u132,
        return 0;
 }
-static int queue_int_on_old_endpoint(struct u132 *u132, struct u132_udev *udev,
+static int queue_int_on_old_endpoint(struct u132 *u132,
-        struct usb_host_endpoint *hep, struct urb *urb,
+        struct u132_udev *udev, struct urb *urb,
        struct usb_device *usb_dev, struct u132_endp *endp, u8 usb_addr,
        u8 usb_endp, u8 address)
 {
@@ -1964,21 +1977,33 @@ static int queue_int_on_old_endpoint(struct u132 *u132, struct u132_udev *udev,
 }
 static int create_endpoint_and_queue_bulk(struct u132 *u132,
-        struct u132_udev *udev, struct usb_host_endpoint *hep, struct urb *urb,
+        struct u132_udev *udev, struct urb *urb,
        struct usb_device *usb_dev, u8 usb_addr, u8 usb_endp, u8 address,
        gfp_t mem_flags)
 {
        int ring_number;
        struct u132_ring *ring;
        unsigned long irqs;
-        u8 endp_number = ++u132->num_endpoints;
+        int rc;
-        struct u132_endp *endp = hep->hcpriv = u132->endp[endp_number - 1] =
+        u8 endp_number;
-                kmalloc(sizeof(struct u132_endp), mem_flags);
+        struct u132_endp *endp = kmalloc(sizeof(struct u132_endp), mem_flags);
        if (!endp) {
                return -ENOMEM;
        }
+        spin_lock_init(&endp->queue_lock.slock);
+        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        rc = usb_hcd_link_urb_to_ep(u132_to_hcd(u132), urb);
+        if (rc) {
+                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
+                kfree(endp);
+                return rc;
+        }
+        endp_number = ++u132->num_endpoints;
+        urb->ep->hcpriv = u132->endp[endp_number - 1] = endp;
        INIT_DELAYED_WORK(&endp->scheduler, u132_hcd_endp_work_scheduler);
-        spin_lock_init(&endp->queue_lock.slock);
        INIT_LIST_HEAD(&endp->urb_more);
        endp->dequeueing = 0;
        endp->edset_flush = 0;
@@ -1986,7 +2011,7 @@ static int create_endpoint_and_queue_bulk(struct u132 *u132,
        endp->delayed = 0;
        endp->endp_number = endp_number;
        endp->u132 = u132;
-        endp->hep = hep;
+        endp->hep = urb->ep;
        endp->pipetype = usb_pipetype(urb->pipe);
        u132_endp_init_kref(u132, endp);
        if (usb_pipein(urb->pipe)) {
@@ -2015,7 +2040,6 @@ static int create_endpoint_and_queue_bulk(struct u132 *u132,
        }
        ring->length += 1;
        urb->hcpriv = u132;
-        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
        endp->udev_number = address;
        endp->usb_addr = usb_addr;
        endp->usb_endp = usb_endp;
@@ -2029,7 +2053,7 @@ static int create_endpoint_and_queue_bulk(struct u132 *u132,
 }
 static int queue_bulk_on_old_endpoint(struct u132 *u132, struct u132_udev *udev,
-         struct usb_host_endpoint *hep, struct urb *urb,
+        struct urb *urb,
        struct usb_device *usb_dev, struct u132_endp *endp, u8 usb_addr,
        u8 usb_endp, u8 address)
 {
@@ -2051,19 +2075,32 @@ static int queue_bulk_on_old_endpoint(struct u132 *u132, struct u132_udev *udev,
 }
 static int create_endpoint_and_queue_control(struct u132 *u132,
-        struct usb_host_endpoint *hep, struct urb *urb,
+        struct urb *urb,
        struct usb_device *usb_dev, u8 usb_addr, u8 usb_endp,
        gfp_t mem_flags)
 {
        struct u132_ring *ring;
-        u8 endp_number = ++u132->num_endpoints;
+        unsigned long irqs;
-        struct u132_endp *endp = hep->hcpriv = u132->endp[endp_number - 1] =
+        int rc;
-                kmalloc(sizeof(struct u132_endp), mem_flags);
+        u8 endp_number;
+        struct u132_endp *endp = kmalloc(sizeof(struct u132_endp), mem_flags);
        if (!endp) {
                return -ENOMEM;
        }
+        spin_lock_init(&endp->queue_lock.slock);
+        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        rc = usb_hcd_link_urb_to_ep(u132_to_hcd(u132), urb);
+        if (rc) {
+                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
+                kfree(endp);
+                return rc;
+        }
+        endp_number = ++u132->num_endpoints;
+        urb->ep->hcpriv = u132->endp[endp_number - 1] = endp;
        INIT_DELAYED_WORK(&endp->scheduler, u132_hcd_endp_work_scheduler);
-        spin_lock_init(&endp->queue_lock.slock);
        INIT_LIST_HEAD(&endp->urb_more);
        ring = endp->ring = &u132->ring[0];
        if (ring->curr_endp) {
@@ -2079,11 +2116,10 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
        endp->delayed = 0;
        endp->endp_number = endp_number;
        endp->u132 = u132;
-        endp->hep = hep;
+        endp->hep = urb->ep;
        u132_endp_init_kref(u132, endp);
        u132_endp_get_kref(u132, endp);
        if (usb_addr == 0) {
-                unsigned long irqs;
                u8 address = u132->addr[usb_addr].address;
                struct u132_udev *udev = &u132->udev[address];
                endp->udev_number = address;
@@ -2097,7 +2133,6 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
                udev->endp_number_in[usb_endp] = endp_number;
                udev->endp_number_out[usb_endp] = endp_number;
                urb->hcpriv = u132;
-                spin_lock_irqsave(&endp->queue_lock.slock, irqs);
                endp->queue_size = 1;
                endp->queue_last = 0;
                endp->queue_next = 0;
@@ -2106,7 +2141,6 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
                u132_endp_queue_work(u132, endp, 0);
                return 0;
        } else {                /*(usb_addr > 0) */
-                unsigned long irqs;
                u8 address = u132->addr[usb_addr].address;
                struct u132_udev *udev = &u132->udev[address];
                endp->udev_number = address;
@@ -2120,7 +2154,6 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
                udev->endp_number_in[usb_endp] = endp_number;
                udev->endp_number_out[usb_endp] = endp_number;
                urb->hcpriv = u132;
-                spin_lock_irqsave(&endp->queue_lock.slock, irqs);
                endp->queue_size = 1;
                endp->queue_last = 0;
                endp->queue_next = 0;
@@ -2132,7 +2165,7 @@ static int create_endpoint_and_queue_control(struct u132 *u132,
 }
 static int queue_control_on_old_endpoint(struct u132 *u132,
-        struct usb_host_endpoint *hep, struct urb *urb,
+        struct urb *urb,
        struct usb_device *usb_dev, struct u132_endp *endp, u8 usb_addr,
        u8 usb_endp)
 {
@@ -2232,8 +2265,8 @@ static int queue_control_on_old_endpoint(struct u132 *u132,
        }
 }
-static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
+static int u132_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
-        struct urb *urb, gfp_t mem_flags)
+                gfp_t mem_flags)
 {
        struct u132 *u132 = hcd_to_u132(hcd);
        if (irqs_disabled()) {
@@ -2258,16 +2291,24 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                if (usb_pipetype(urb->pipe) == PIPE_INTERRUPT) {
                        u8 address = u132->addr[usb_addr].address;
                        struct u132_udev *udev = &u132->udev[address];
-                        struct u132_endp *endp = hep->hcpriv;
+                        struct u132_endp *endp = urb->ep->hcpriv;
                        urb->actual_length = 0;
                        if (endp) {
                                unsigned long irqs;
                                int retval;
                                spin_lock_irqsave(&endp->queue_lock.slock,
                                        irqs);
-                                retval = queue_int_on_old_endpoint(u132, udev,
+                                retval = usb_hcd_link_urb_to_ep(hcd, urb);
-                                        hep, urb, usb_dev, endp, usb_addr,
+                                if (retval == 0) {
-                                        usb_endp, address);
+                                        retval = queue_int_on_old_endpoint(
+                                                        u132, udev, urb,
+                                                        usb_dev, endp,
+                                                        usb_addr, usb_endp,
+                                                        address);
+                                        if (retval)
+                                                usb_hcd_unlink_urb_from_ep(
+                                                                hcd, urb);
+                                }
                                spin_unlock_irqrestore(&endp->queue_lock.slock,
                                        irqs);
                                if (retval) {
@@ -2282,8 +2323,8 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                                return -EINVAL;
                        } else {        /*(endp == NULL) */
                                return create_endpoint_and_queue_int(u132, udev,
-                                         hep, urb, usb_dev, usb_addr, usb_endp,
+                                                urb, usb_dev, usb_addr,
-                                        address, mem_flags);
+                                                usb_endp, address, mem_flags);
                        }
                } else if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) {
                        dev_err(&u132->platform_dev->dev, "the hardware does no"
@@ -2292,16 +2333,24 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                } else if (usb_pipetype(urb->pipe) == PIPE_BULK) {
                        u8 address = u132->addr[usb_addr].address;
                        struct u132_udev *udev = &u132->udev[address];
-                        struct u132_endp *endp = hep->hcpriv;
+                        struct u132_endp *endp = urb->ep->hcpriv;
                        urb->actual_length = 0;
                        if (endp) {
                                unsigned long irqs;
                                int retval;
                                spin_lock_irqsave(&endp->queue_lock.slock,
                                        irqs);
-                                retval = queue_bulk_on_old_endpoint(u132, udev,
+                                retval = usb_hcd_link_urb_to_ep(hcd, urb);
-                                        hep, urb, usb_dev, endp, usb_addr,
+                                if (retval == 0) {
-                                        usb_endp, address);
+                                        retval = queue_bulk_on_old_endpoint(
+                                                        u132, udev, urb,
+                                                        usb_dev, endp,
+                                                        usb_addr, usb_endp,
+                                                        address);
+                                        if (retval)
+                                                usb_hcd_unlink_urb_from_ep(
+                                                                hcd, urb);
+                                }
                                spin_unlock_irqrestore(&endp->queue_lock.slock,
                                        irqs);
                                if (retval) {
@@ -2314,10 +2363,10 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                                return -EINVAL;
                        } else
                                return create_endpoint_and_queue_bulk(u132,
-                                        udev, hep, urb, usb_dev, usb_addr,
+                                        udev, urb, usb_dev, usb_addr,
                                        usb_endp, address, mem_flags);
                } else {
-                        struct u132_endp *endp = hep->hcpriv;
+                        struct u132_endp *endp = urb->ep->hcpriv;
                        u16 urb_size = 8;
                        u8 *b = urb->setup_packet;
                        int i = 0;
@@ -2340,9 +2389,16 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                                int retval;
                                spin_lock_irqsave(&endp->queue_lock.slock,
                                        irqs);
-                                retval = queue_control_on_old_endpoint(u132,
+                                retval = usb_hcd_link_urb_to_ep(hcd, urb);
-                                        hep, urb, usb_dev, endp, usb_addr,
+                                if (retval == 0) {
-                                        usb_endp);
+                                        retval = queue_control_on_old_endpoint(
+                                                        u132, urb, usb_dev,
+                                                        endp, usb_addr,
+                                                        usb_endp);
+                                        if (retval)
+                                                usb_hcd_unlink_urb_from_ep(
+                                                                hcd, urb);
+                                }
                                spin_unlock_irqrestore(&endp->queue_lock.slock,
                                        irqs);
                                if (retval) {
@@ -2355,7 +2411,7 @@ static int u132_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *hep,
                                return -EINVAL;
                        } else
                                return create_endpoint_and_queue_control(u132,
-                                        hep, urb, usb_dev, usb_addr, usb_endp,
+                                        urb, usb_dev, usb_addr, usb_endp,
                                        mem_flags);
                }
        }
@@ -2390,10 +2446,17 @@ static int dequeue_from_overflow_chain(struct u132 *u132,
 }
 static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
-        struct urb *urb)
+                struct urb *urb, int status)
 {
        unsigned long irqs;
+        int rc;
        spin_lock_irqsave(&endp->queue_lock.slock, irqs);
+        rc = usb_hcd_check_unlink_urb(u132_to_hcd(u132), urb, status);
+        if (rc) {
+                spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
+                return rc;
+        }
        if (endp->queue_size == 0) {
                dev_err(&u132->platform_dev->dev, "urb=%p not found in endp[%d]"
                        "=%p ring[%d] %c%c usb_endp=%d usb_addr=%d\n", urb,
@@ -2438,6 +2501,8 @@ static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
                }
                if (urb_slot) {
                        struct usb_hcd *hcd = u132_to_hcd(u132);
+                        usb_hcd_unlink_urb_from_ep(hcd, urb);
                        endp->queue_size -= 1;
                        if (list_empty(&endp->urb_more)) {
                                spin_unlock_irqrestore(&endp->queue_lock.slock,
@@ -2467,7 +2532,10 @@ static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
                        spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
                        return -EINVAL;
                } else {
-                        int retval = dequeue_from_overflow_chain(u132, endp,
+                        int retval;
+                        usb_hcd_unlink_urb_from_ep(u132_to_hcd(u132), urb);
+                        retval = dequeue_from_overflow_chain(u132, endp,
                                urb);
                        spin_unlock_irqrestore(&endp->queue_lock.slock, irqs);
                        return retval;
@@ -2475,7 +2543,7 @@ static int u132_endp_urb_dequeue(struct u132 *u132, struct u132_endp *endp,
        }
 }
-static int u132_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int u132_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct u132 *u132 = hcd_to_u132(hcd);
        if (u132->going > 2) {
@@ -2490,11 +2558,11 @@ static int u132_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
                if (usb_pipein(urb->pipe)) {
                        u8 endp_number = udev->endp_number_in[usb_endp];
                        struct u132_endp *endp = u132->endp[endp_number - 1];
-                        return u132_endp_urb_dequeue(u132, endp, urb);
+                        return u132_endp_urb_dequeue(u132, endp, urb, status);
                } else {
                        u8 endp_number = udev->endp_number_out[usb_endp];
                        struct u132_endp *endp = u132->endp[endp_number - 1];
-                        return u132_endp_urb_dequeue(u132, endp, urb);
+                        return u132_endp_urb_dequeue(u132, endp, urb, status);
                }
        }
 }
diff --git a/drivers/usb/host/uhci-q.c b/drivers/usb/host/uhci-q.c
index 3bb908ca38e9..bff200cb3d2e 100644
--- a/drivers/usb/host/uhci-q.c
+++ b/drivers/usb/host/uhci-q.c
@@ -1376,7 +1376,6 @@ static int uhci_result_isochronous(struct uhci_hcd *uhci, struct urb *urb)
 }
 static int uhci_urb_enqueue(struct usb_hcd *hcd,
-                struct usb_host_endpoint *hep,
                struct urb *urb, gfp_t mem_flags)
 {
        int ret;
@@ -1387,19 +1386,19 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
        spin_lock_irqsave(&uhci->lock, flags);
-        ret = urb->status;
+        ret = usb_hcd_link_urb_to_ep(hcd, urb);
-        if (ret != -EINPROGRESS)                /* URB already unlinked! */
+        if (ret)
-                goto done;
+                goto done_not_linked;
        ret = -ENOMEM;
        urbp = uhci_alloc_urb_priv(uhci, urb);
        if (!urbp)
                goto done;
-        if (hep->hcpriv)
+        if (urb->ep->hcpriv)
-                qh = (struct uhci_qh *) hep->hcpriv;
+                qh = urb->ep->hcpriv;
        else {
-                qh = uhci_alloc_qh(uhci, urb->dev, hep);
+                qh = uhci_alloc_qh(uhci, urb->dev, urb->ep);
                if (!qh)
                        goto err_no_qh;
        }
@@ -1440,27 +1439,29 @@ static int uhci_urb_enqueue(struct usb_hcd *hcd,
 err_submit_failed:
        if (qh->state == QH_STATE_IDLE)
                uhci_make_qh_idle(uhci, qh);    /* Reclaim unused QH */
 err_no_qh:
        uhci_free_urb_priv(uhci, urbp);
 done:
+        if (ret)
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+done_not_linked:
        spin_unlock_irqrestore(&uhci->lock, flags);
        return ret;
 }
-static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
+static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
        struct uhci_hcd *uhci = hcd_to_uhci(hcd);
        unsigned long flags;
-        struct urb_priv *urbp;
        struct uhci_qh *qh;
+        int rc;
        spin_lock_irqsave(&uhci->lock, flags);
-        urbp = urb->hcpriv;
+        rc = usb_hcd_check_unlink_urb(hcd, urb, status);
-        if (!urbp)                      /* URB was never linked! */
+        if (rc)
                goto done;
-        qh = urbp->qh;
+        qh = ((struct urb_priv *) urb->hcpriv)->qh;
        /* Remove Isochronous TDs from the frame list ASAP */
        if (qh->type == USB_ENDPOINT_XFER_ISOC) {
@@ -1477,7 +1478,7 @@ static int uhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb)
 done:
        spin_unlock_irqrestore(&uhci->lock, flags);
-        return 0;
+        return rc;
 }
 /*
@@ -1529,6 +1530,7 @@ __acquires(uhci->lock)
        }
        uhci_free_urb_priv(uhci, urbp);
+        usb_hcd_unlink_urb_from_ep(uhci_to_hcd(uhci), urb);
        spin_unlock(&uhci->lock);
        usb_hcd_giveback_urb(uhci_to_hcd(uhci), urb);