[Bug 297053] xhci(4): TRB-array memory corruption and kernel panic for bulk frames larger than 64 KiB

[email protected] Mon, 27 Jul 2026 05:31:52 +0000

Newsgroups	gmane.os.freebsd.bugs
Message-ID	<[email protected]/bugzilla/>

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D297053

--- Comment #3 from [email protected] ---
A commit in branch main references this bug:

URL:
https://cgit.FreeBSD.org/src/commit/?id=3De3e56236bcae96a44dc47be5e3a7ffac3=
322b49f

commit e3e56236bcae96a44dc47be5e3a7ffac3322b49f
Author:     ShengYi Hung <[email protected]>
AuthorDate: 2026-07-26 06:35:11 +0000
Commit:     ShengYi Hung <[email protected]>
CommitDate: 2026-07-27 05:31:12 +0000

    xhci: Fix packet xfer larger than 64kb

    Previously, multiple frames of xfers are split into many tds. In the
    refactor process, we forget to consider this. The td builder is already
    allocate with enough numbers of tds. What we need to do is to fill the
    normal trbs for muiltiple tds when building trbs.

    PR:             297053
    Tested by:      phk, [email protected]
    Fixes:  e0b235ecd4fa ("xhci: Refactor xhci_generic_setup code")
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58465

 sys/dev/usb/controller/xhci.c | 190 +++++++++++++++++++++++++++-----------=
----
 1 file changed, 121 insertions(+), 69 deletions(-)

--=20
You are receiving this mail because:
You are the assignee for the bug.=