xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them.

PCI xHC host should be stopped and xhci driver memory freed before putting
host to PCI D3 state during PCI remove callback.

Hosts with XHCI_SPURIOUS_WAKEUP quirk did this the wrong way around
and set the host to D3 before calling usb_hcd_pci_remove(dev), which will
access the host to stop it, and then free xhci.

Fixes: f1f6d9a8b540 ("xhci: don't dereference a xhci member after removing xhci")
Cc: stable@vger.kernel.org
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20240905143300.1959279-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 526739af2070a574cdc20f6a3edeadcfd180269b..de50f5ba60df7b081e91927973e617cc71fefdcf 100644 (file)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -657,8 +657,10 @@ static int xhci_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
 void xhci_pci_remove(struct pci_dev *dev)
 {
        struct xhci_hcd *xhci;
+       bool set_power_d3;
 
        xhci = hcd_to_xhci(pci_get_drvdata(dev));
+       set_power_d3 = xhci->quirks & XHCI_SPURIOUS_WAKEUP;
 
        xhci->xhc_state |= XHCI_STATE_REMOVING;
 
@@ -671,11 +673,11 @@ void xhci_pci_remove(struct pci_dev *dev)
                xhci->shared_hcd = NULL;
        }
 
+       usb_hcd_pci_remove(dev);
+
        /* Workaround for spurious wakeups at shutdown with HSW */
-       if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
+       if (set_power_d3)
                pci_set_power_state(dev, PCI_D3hot);
-
-       usb_hcd_pci_remove(dev);
 }
 EXPORT_SYMBOL_NS_GPL(xhci_pci_remove, xhci);