[PATCH 3/4] usb: xhci: Give back URBs on halted disconnected endpoints

[Michal Pecio <michal.pecio@gmail.com>]

Bailing out of xhci_handle_halted_endpoint() on disconnected devices
had a side effect of leaving the failed URB and other URBs stranded
until the driver times out or its disconnect() routine runs and the
URBs are unlinked. And since disconnect() can't run during probe(),
only timeouts remained, slowing down error handling and making some
devices which disconnect during probe fail to probe altogether.

Ensure giveback of all URBs when we don't queue Reset Endpoint.
Set return status to 0, because the only caller that looks at it is
xhci_handle_cmd_stop_ep(), which would only repeat an equivalent of
xhci_process_cancelled_tds() if we return -ENODEV.

Reported-by: Yiyu Zhou <yiyu@yiyuzhou.io>
Link: https://lore.kernel.org/linux-usb/20261010064407.11030-1-yiyu@yiyuzhou.io/
Reported-by: Dennis Wissel <dennis@dsine.de>
Link: https://lore.kernel.org/linux-usb/SrQQcLIwRWyg9PdEIpc0eg@dsine.de/
Fixes: 7e0ef4332ed9 ("xhci: avoid xHC endpoint changes after disconnect or link error.")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
---
 drivers/usb/host/xhci-ring.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 14cfb025c365..1097600699d4 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -993,13 +993,14 @@ static int xhci_handle_halted_endpoint(struct xhci_hcd *xhci,
 	int err;
 
 	/*
-	 * Avoid resetting endpoint if link is inactive or device disonnected.
-	 * Can cause host hang.
-	 * Device will be reset to recover an inactive link, so don't do anything
+	 * Flag endpoints behind disconnected RH ports and override soft retries.
+	 * Restarting them is futile and known to trigger HC bugs on USB3 buses.
 	 */
 	if (rhub_port->link_inactive || !rhub_port->connected) {
+		xhci_dbg(xhci, "Halted slot %d ep %d is lost\n",
+				slot_id, ep->ep_index);
 		ep->ep_state |= EP_DROP_PENDING;
-		return -ENODEV;
+		reset_type = EP_HARD_RESET;
 	}
 
 	/* add td to cancelled list and let reset ep handler take care of it */
@@ -1017,6 +1018,12 @@ static int xhci_handle_halted_endpoint(struct xhci_hcd *xhci,
 		return 0;
 	}
 
+	/* Don't reset lost endpoints, only EP0 can survive device reset */
+	if (ep->ep_state & EP_DROP_PENDING && ep->ep_index != 0) {
+		xhci_process_cancelled_tds(xhci, ep);
+		return 0;
+	}
+
 	err = xhci_reset_halted_ep(xhci, slot_id, ep->ep_index, reset_type);
 	if (err)
 		return err;
-- 
2.48.1