diff -r f4e4b15bad85 sys/dev/usb/xhci.c
--- a/sys/dev/usb/xhci.c	Fri May 29 03:18:32 2020 +0000
+++ b/sys/dev/usb/xhci.c	Sat Jan 16 20:39:21 2021 +0000
@@ -129,6 +129,7 @@ fail:
 struct xhci_pipe {
 	struct usbd_pipe xp_pipe;
 	struct usb_task xp_async_task;
+	struct usbd_xfer *xp_stalled_xfer;
 	int16_t xp_isoc_next; /* next frame */
 	uint8_t xp_maxb; /* max burst */
 	uint8_t xp_mult;
@@ -159,6 +160,8 @@ static usbd_status xhci_configure_endpoi
 static usbd_status xhci_reset_endpoint(struct usbd_pipe *);
 static usbd_status xhci_stop_endpoint(struct usbd_pipe *);
 
+static void xhci_clear_endpoint_stall_async_task(void *);
+
 static void xhci_host_dequeue(struct xhci_ring * const);
 static usbd_status xhci_set_dequeue(struct usbd_pipe *);
 
@@ -1676,6 +1679,9 @@ xhci_open(struct usbd_pipe *pipe)
 		return err;
 	}
 
+	usb_init_task(&xpipe->xp_async_task,
+	    xhci_clear_endpoint_stall_async_task, xpipe, USB_TASKQ_MPSAFE);
+
 	if (ed->bEndpointAddress != USB_CONTROL_ENDPOINT)
 		return xhci_configure_endpoint(pipe);
 
@@ -1766,6 +1772,8 @@ xhci_abortx(struct usbd_xfer *xfer)
 	struct xhci_softc * const sc = XHCI_XFER2SC(xfer);
 	struct xhci_slot * const xs = xfer->ux_pipe->up_dev->ud_hcpriv;
 	const u_int dci = xhci_ep_get_dci(xfer->ux_pipe->up_endpoint->ue_edesc);
+	struct xhci_pipe * const xp = container_of(xfer->ux_pipe,
+	    struct xhci_pipe, xp_pipe);
 
 	XHCIHIST_CALLARGS("xfer %#jx pipe %#jx",
 	    (uintptr_t)xfer, (uintptr_t)xfer->ux_pipe, 0, 0);
@@ -1778,6 +1786,13 @@ xhci_abortx(struct usbd_xfer *xfer)
 	    "bad abort status: %d", xfer->ux_status);
 
 	/*
+	 * Wait for any clear-endpoint-stall task to complete -- if we
+	 * have gotten to this point, then it has lost the race.
+	 */
+	usb_rem_task_wait(xfer->ux_pipe->up_dev, &xp->xp_async_task,
+	    USB_TASKQ_HC, &sc->sc_lock);
+
+	/*
 	 * If we're dying, skip the hardware action and just notify the
 	 * software that we're done.
 	 */
@@ -1844,7 +1859,8 @@ xhci_host_dequeue(struct xhci_ring * con
 static void
 xhci_clear_endpoint_stall_async_task(void *cookie)
 {
-	struct usbd_xfer * const xfer = cookie;
+	struct xhci_pipe * const xp = cookie;
+	struct usbd_xfer * const xfer = xp->xp_stalled_xfer;
 	struct xhci_softc * const sc = XHCI_XFER2SC(xfer);
 	struct xhci_slot * const xs = xfer->ux_pipe->up_dev->ud_hcpriv;
 	const u_int dci = xhci_ep_get_dci(xfer->ux_pipe->up_endpoint->ue_edesc);
@@ -1873,31 +1889,32 @@ xhci_clear_endpoint_stall_async_task(voi
 	xhci_set_dequeue(xfer->ux_pipe);
 
 	mutex_enter(&sc->sc_lock);
+	xp->xp_stalled_xfer = NULL;
 	tr->is_halted = false;
-	usb_transfer_complete(xfer);
+	if (usbd_xfer_trycomplete(xfer)) {
+		xfer->ux_status = USBD_STALLED;
+		usb_transfer_complete(xfer);
+	}
 	mutex_exit(&sc->sc_lock);
 	DPRINTFN(4, "ends", 0, 0, 0, 0);
 }
 
-static usbd_status
+static void
 xhci_clear_endpoint_stall_async(struct usbd_xfer *xfer)
 {
 	struct xhci_softc * const sc = XHCI_XFER2SC(xfer);
-	struct xhci_pipe * const xp = (struct xhci_pipe *)xfer->ux_pipe;
+	struct xhci_pipe * const xp = container_of(xfer->ux_pipe,
+	    struct xhci_pipe, xp_pipe);
 
 	XHCIHIST_FUNC();
 	XHCIHIST_CALLARGS("xfer %#jx", (uintptr_t)xfer, 0, 0, 0);
 
-	if (sc->sc_dying) {
-		return USBD_IOERROR;
-	}
-
-	usb_init_task(&xp->xp_async_task,
-	    xhci_clear_endpoint_stall_async_task, xfer, USB_TASKQ_MPSAFE);
+	KASSERT(xhci_polling_p(sc) || mutex_owned(&sc->sc_lock));
+	KASSERT(xp->xp_stalled_xfer == NULL);
+
+	xp->xp_stalled_xfer = xfer;
 	usb_add_task(xfer->ux_pipe->up_dev, &xp->xp_async_task, USB_TASKQ_HC);
 	DPRINTFN(4, "ends", 0, 0, 0, 0);
-
-	return USBD_NORMAL_COMPLETION;
 }
 
 /* Process roothub port status/change events and notify to uhub_intr. */
@@ -2075,12 +2092,6 @@ xhci_event_transfer(struct xhci_softc * 
 	case XHCI_TRB_ERROR_BABBLE:
 		DPRINTFN(1, "ERR %ju slot %ju dci %ju", trbcode, slot, dci, 0);
 		xr->is_halted = true;
-		/*
-		 * Try to claim this xfer for completion.  If it has already
-		 * completed or aborted, drop it on the floor.
-		 */
-		if (!usbd_xfer_trycomplete(xfer))
-			return;
 
 		/*
 		 * Stalled endpoints can be recoverd by issuing
@@ -2096,9 +2107,6 @@ xhci_event_transfer(struct xhci_softc * 
 		 * UF_ENDPOINT_HALT).
 		 */
 
-		/* Override the status.  */
-		xfer->ux_status = USBD_STALLED;
-
 		xhci_clear_endpoint_stall_async(xfer);
 		return;
 	default: