xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.

commit f81dfa3b57c624c56f2bff171c431bc7f5b558f2 upstream.

PCI xHC host should be stopped and xhci driver memory freed before putting
host to PCI D3 state during PCI remove callback.

Hosts with XHCI_SPURIOUS_WAKEUP quirk did this the wrong way around
and set the host to D3 before calling usb_hcd_pci_remove(dev), which will
access the host to stop it, and then free xhci.

Fixes: f1f6d9a8b540 ("xhci: don't dereference a xhci member after removing xhci")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240905143300.1959279-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 3a7d34ca457ecdc73c8aef634c0b48d9472e7e65..19527b856c55013beb83801fef98bf1c3d6d96ca 100644 (file)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -662,8 +662,10 @@ put_runtime_pm:
 static void xhci_pci_remove(struct pci_dev *dev)
 {
        struct xhci_hcd *xhci;
+       bool set_power_d3;
 
        xhci = hcd_to_xhci(pci_get_drvdata(dev));
+       set_power_d3 = xhci->quirks & XHCI_SPURIOUS_WAKEUP;
 
        xhci->xhc_state |= XHCI_STATE_REMOVING;
 
@@ -676,11 +678,11 @@ static void xhci_pci_remove(struct pci_dev *dev)
                xhci->shared_hcd = NULL;
        }
 
+       usb_hcd_pci_remove(dev);
+
        /* Workaround for spurious wakeups at shutdown with HSW */
-       if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+       if (set_power_d3)
                pci_set_power_state(dev, PCI_D3hot);
-
-       usb_hcd_pci_remove(dev);
 }
 
 /*