Re: [PATCH] xhci: fix lost bounce buffers on TDs spanning several ring segments

On Tue, Aug 11, 2026 at 8:42 AM Michal Pecio <[email protected]> wrote:
> >   device-mapper: verity: 8:2: metadata block 10850 is corrupted
>
> Quite nasty, and not everybody uses dm-verify in particular. It seems
> corruption could also affect rare FAT filesystems with tiny clusters.

I've triggered it very reliably via the dm-verity prefetcher. For the
last 6 months,
my workaround to the crash was disabling the prefetcher, to the cost
of performance.

See https://bugzilla.kernel.org/show_bug.cgi?id=220861

> > Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
> > Cc: Mathias Nyman <[email protected]>
> > Cc: [email protected]
>
> Note: you don't need to list here the driver maintainer you are sending
> this email to. And no need to *actually* send email to the stable list.

I didn't mean to CC the maintainer here, that CC was for the author of
the commit I was fixing.
The cc just got parsed by git-send-email and sent it automatically.

> > +     if (!ring || !td->bounce_seg || !td->urb)
> > +             return;
>
> Tiny optimization nit: !td->bounce_seg is by far the most likely case,
> so it could be first. The others guard against bugs and "never happen".

Noted.

> Hmm, AI patch? I think most people would write it like below :)

I used AI to walk me through the trb/td logic I was unfamiliar with. This was
a copy paste of one output.

> The code looks correct, though I would do it differently: store the
> last bounce_seg and run the loop from td->start_seg to td->bounce_seg.
> This avoids adding the 'if' during enqueue, and still works correctly
> if the TD wraps around the whole ring so that end_seg == start_seg.

That makes the patch significantly smaller. See the V2.
(https://lore.kernel.org/linux-usb/[email protected]/T/#u)

Thank you both!