2 files changed, 31 insertions, 22 deletions

diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index 386eaa22d215..4ac4300a3f9a 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -267,6 +267,8 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work)
         mutex_lock(&wusbhc->mutex);
         wusbhc_devconnect_acked(wusbhc, wusb_dev);
         mutex_unlock(&wusbhc->mutex);
+
+        wusb_dev_put(wusb_dev);
 }
 
 /*
@@ -396,7 +398,8 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
 
         /* After a device disconnects, change the GTK (see [WUSB]
          * section 6.2.11.2). */
-        wusbhc_gtk_rekey(wusbhc);
+        if (wusbhc->active)
+                wusbhc_gtk_rekey(wusbhc);
 
         /* The Wireless USB part has forgotten about the device already; now
          * khubd's timer will pick up the disconnection and remove the USB
@@ -1084,15 +1087,21 @@ error_mmcie_set:
  * wusbhc_devconnect_stop - stop managing connected devices
  * @wusbhc: the WUSB HC
  *
- * Removes the Host Info IE and stops the keep alives.
- *
- * FIXME: should this disconnect all devices?
+ * Disconnects any devices still connected, stops the keep alives and
+ * removes the Host Info IE.
  */
 void wusbhc_devconnect_stop(struct wusbhc *wusbhc)
 {
-        cancel_delayed_work_sync(&wusbhc->keep_alive_timer);
-        WARN_ON(!list_empty(&wusbhc->cack_list));
+        int i;
 
+        mutex_lock(&wusbhc->mutex);
+        for (i = 0; i < wusbhc->ports_max; i++) {
+                if (wusbhc->port[i].wusb_dev)
+                        __wusbhc_dev_disconnect(wusbhc, &wusbhc->port[i]);
+        }
+        mutex_unlock(&wusbhc->mutex);
+
+        cancel_delayed_work_sync(&wusbhc->keep_alive_timer);
         wusbhc_mmcie_rm(wusbhc, &wusbhc->wuie_host_info->hdr);
         kfree(wusbhc->wuie_host_info);
         wusbhc->wuie_host_info = NULL;
diff --git a/drivers/usb/wusbcore/wusbhc.c b/drivers/usb/wusbcore/wusbhc.c
index 07c63a31c799..ee6256f23636 100644
--- a/drivers/usb/wusbcore/wusbhc.c
+++ b/drivers/usb/wusbcore/wusbhc.c
@@ -88,33 +88,31 @@ static DEVICE_ATTR(wusb_trust_timeout, 0644, wusb_trust_timeout_show,
                                              wusb_trust_timeout_store);
 
 /*
- * Show & store the current WUSB CHID
+ * Show the current WUSB CHID.
  */
 static ssize_t wusb_chid_show(struct device *dev,
                               struct device_attribute *attr, char *buf)
 {
         struct wusbhc *wusbhc = usbhc_dev_to_wusbhc(dev);
+        const struct wusb_ckhdid *chid;
         ssize_t result = 0;
 
         if (wusbhc->wuie_host_info != NULL)
-                result += ckhdid_printf(buf, PAGE_SIZE,
-                                        &wusbhc->wuie_host_info->CHID);
+                chid = &wusbhc->wuie_host_info->CHID;
+        else
+                chid = &wusb_ckhdid_zero;
+
+        result += ckhdid_printf(buf, PAGE_SIZE, chid);
+        result += sprintf(buf + result, "\n");
+
         return result;
 }
 
 /*
- * Store a new CHID
- *
- * This will (FIXME) trigger many changes.
- *
- * - Send an all zeros CHID and it will stop the controller
- * - Send a non-zero CHID and it will start it
- *   (unless it was started, it will just change the CHID,
- *   diconnecting all devices first).
+ * Store a new CHID.
  *
- * So first we scan the MMC we are sent and then we act on it.  We
- * read it in the same format as we print it, an ASCII string of 16
- * hex bytes.
+ * - Write an all zeros CHID and it will stop the controller
+ * - Write a non-zero CHID and it will start it.
  *
  * See wusbhc_chid_set() for more info.
  */
@@ -339,13 +337,15 @@ void wusbhc_giveback_urb(struct wusbhc *wusbhc, struct urb *urb, int status)
 {
         struct wusb_dev *wusb_dev = __wusb_dev_get_by_usb_dev(wusbhc, urb->dev);
 
-        if (status == 0) {
+        if (status == 0 && wusb_dev) {
                 wusb_dev->entry_ts = jiffies;
 
-                /* wusbhc_devconnect_acked() can't be called from from
+                /* wusbhc_devconnect_acked() can't be called from
                    atomic context so defer it to a work queue. */
                 if (!list_empty(&wusb_dev->cack_node))
                         queue_work(wusbd, &wusb_dev->devconnect_acked_work);
+                else
+                        wusb_dev_put(wusb_dev);
         }
 
         usb_hcd_giveback_urb(&wusbhc->usb_hcd, urb, status);