[PATCH 2/4] usb: xhci: Give back stranded URBs on disconnected endpoints

[Michal Pecio <michal.pecio@gmail.com>]

When a URB is unlinked and Stop Endpoint handler sets EP_DROP_PENDING,
the endpoint won't be restarted and URBs will be hanging until drivers
unlink them, possibly only after a long timeout.

For control endpoints, cancel all remaining URBs before invalidation
and then process them normally to ensure proper ring cleanup. On other
endpoints just nuke remaining URBs after cancelled TD processing; URBs
which are already cancelled are still returned normally.

Based on ideas from patches by Yiyu Zhou and Mathias Nyman, reworked
to integrate deeper with existing infrastructure and cover more cases.

Fixes: 7e0ef4332ed9 ("xhci: avoid xHC endpoint changes after disconnect or link error.")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
---
 drivers/usb/host/xhci-ring.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 7049787725fb..14cfb025c365 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -62,6 +62,7 @@
 #include "xhci.h"
 #include "xhci-trace.h"
 
+static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci, int slot_id, int ep_index);
 static int queue_command(struct xhci_hcd *xhci, struct xhci_command *cmd,
 			 u32 field1, u32 field2,
 			 u32 field3, u32 field4, bool command_must_succeed);
@@ -951,6 +952,11 @@ static void xhci_giveback_invalidated_tds(struct xhci_hcd *xhci, struct xhci_vir
 		if (xhci->xhc_state & XHCI_STATE_DYING)
 			return;
 	}
+
+	/* Nuke stranded URBs if there is no one to give them back */
+	if ((ep->ep_state & EP_DROP_PENDING) &&
+	    !(ep->ep_state & (EP_HALTED | SET_DEQ_PENDING | EP_STOP_CMD_PENDING)))
+		xhci_kill_endpoint_urbs(xhci, ep->vdev->slot_id, ep->ep_index);
 }
 
 static int xhci_reset_halted_ep(struct xhci_hcd *xhci, unsigned int slot_id,
@@ -1047,6 +1053,20 @@ static int xhci_invalidate_cancelled_tds(struct xhci_hcd *xhci, struct xhci_virt
 	if (ep->ep_state & SET_DEQ_PENDING)
 		return 0;
 
+	/*
+	 * Disconnected EP0 may be reused when core "resuscitates" the device,
+	 * so we must clean up its ring properly. Cancel all remaining URBs.
+	 */
+	if (ep->ep_state & EP_DROP_PENDING && ep->ep_index == 0) {
+		list_for_each_entry(td, &ep->ring->td_list, td_list) {
+			if (list_empty(&td->cancelled_td_list)) {
+				list_add_tail(&td->cancelled_td_list, &ep->cancelled_td_list);
+				td->cancel_status = TD_DIRTY;
+				td->status = -ESHUTDOWN;
+			}
+		}
+	}
+
 	list_for_each_entry_safe(td, tmp_td, &ep->cancelled_td_list, cancelled_td_list) {
 		xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
 			       "Removing canceled TD starting at 0x%llx (dma) in stream %u URB %p",
-- 
2.48.1