xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.

[ Upstream commit f81dfa3b57c624c56f2bff171c431bc7f5b558f2 ]

PCI xHC host should be stopped and xhci driver memory freed before putting
host to PCI D3 state during PCI remove callback.

Hosts with XHCI_SPURIOUS_WAKEUP quirk did this the wrong way around
and set the host to D3 before calling usb_hcd_pci_remove(dev), which will
access the host to stop it, and then free xhci.

Fixes: f1f6d9a8b540 ("xhci: don't dereference a xhci member after removing xhci")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240905143300.1959279-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 4a88e75cd9586579f7d0b2767b2f8c9464d487f5..82700a734f8a641a21e6ff306eb11ff7c36edd0d 100644 (file)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -531,8 +531,10 @@ put_runtime_pm:
 static void xhci_pci_remove(struct pci_dev *dev)
 {
        struct xhci_hcd *xhci;
+       bool set_power_d3;
 
        xhci = hcd_to_xhci(pci_get_drvdata(dev));
+       set_power_d3 = xhci->quirks & XHCI_SPURIOUS_WAKEUP;
 
        xhci->xhc_state |= XHCI_STATE_REMOVING;
 
@@ -545,11 +547,11 @@ static void xhci_pci_remove(struct pci_dev *dev)
                xhci->shared_hcd = NULL;
        }
 
+       usb_hcd_pci_remove(dev);
+
        /* Workaround for spurious wakeups at shutdown with HSW */
-       if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+       if (set_power_d3)
                pci_set_power_state(dev, PCI_D3hot);
-
-       usb_hcd_pci_remove(dev);
 }
 
 #ifdef CONFIG_PM