2 files changed, 15 insertions, 3 deletions

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 5ce839137ad6..0f857e645058 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -444,7 +444,7 @@ resubmit:
 static inline int
 hub_clear_tt_buffer (struct usb_device *hdev, u16 devinfo, u16 tt)
 {
-        return usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
+        return usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
                                HUB_CLEAR_TT_BUFFER, USB_RT_PORT, devinfo,
                                tt, NULL, 0, 1000);
 }
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 00ad9ce392ed..139a2cc3f641 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -487,8 +487,20 @@ halt:
                          * we must clear the TT buffer (11.17.5).
                          */
                         if (unlikely(last_status != -EINPROGRESS &&
-                                        last_status != -EREMOTEIO))
-                                ehci_clear_tt_buffer(ehci, qh, urb, token);
+                                        last_status != -EREMOTEIO)) {
+                                /* The TT's in some hubs malfunction when they
+                                 * receive this request following a STALL (they
+                                 * stop sending isochronous packets).  Since a
+                                 * STALL can't leave the TT buffer in a busy
+                                 * state (if you believe Figures 11-48 - 11-51
+                                 * in the USB 2.0 spec), we won't clear the TT
+                                 * buffer in this case.  Strictly speaking this
+                                 * is a violation of the spec.
+                                 */
+                                if (last_status != -EPIPE)
+                                        ehci_clear_tt_buffer(ehci, qh, urb,
+                                                        token);
+                        }
                 }
 
                 /* if we're removing something not at the queue head,