diff --git a/[refs] b/[refs]
index fe3cf5b44a48..379053bcd200 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 28ccd2962c66556d7037b2d9f1c11cdcd3b805d5
+refs/heads/master: 92a3da410aac6e14daaefe13c60368ca28e85830
diff --git a/trunk/drivers/usb/host/xhci-ring.c b/trunk/drivers/usb/host/xhci-ring.c
index 9b1eeb04ce69..e0f05f5abe10 100644
--- a/trunk/drivers/usb/host/xhci-ring.c
+++ b/trunk/drivers/usb/host/xhci-ring.c
@@ -2193,6 +2193,11 @@ static void xhci_handle_event(struct xhci_hcd *xhci)
 	}
 	xhci_dbg(xhci, "%s - OS owns TRB\n", __func__);
 
+	/*
+	 * Barrier between reading the TRB_CYCLE (valid) flag above and any
+	 * speculative reads of the event's flags/data below.
+	 */
+	rmb();
 	/* FIXME: Handle more event types. */
 	switch ((le32_to_cpu(event->event_cmd.flags) & TRB_TYPE_BITMASK)) {
 	case TRB_TYPE(TRB_COMPLETION):