[Bug 297053] xhci(4): TRB-array memory corruption and kernel panic for bulk frames larger than 64 KiB
Date: Mon, 27 Jul 2026 05:31:52 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297053
--- Comment #3 from commit-hook@FreeBSD.org ---
A commit in branch main references this bug:
URL:
https://cgit.FreeBSD.org/src/commit/?id=e3e56236bcae96a44dc47be5e3a7ffac3322b49f
commit e3e56236bcae96a44dc47be5e3a7ffac3322b49f
Author: ShengYi Hung <aokblast@FreeBSD.org>
AuthorDate: 2026-07-26 06:35:11 +0000
Commit: ShengYi Hung <aokblast@FreeBSD.org>
CommitDate: 2026-07-27 05:31:12 +0000
xhci: Fix packet xfer larger than 64kb
Previously, multiple frames of xfers are split into many tds. In the
refactor process, we forget to consider this. The td builder is already
allocate with enough numbers of tds. What we need to do is to fill the
normal trbs for muiltiple tds when building trbs.
PR: 297053
Tested by: phk, oleglelchuk@gmail.com
Fixes: e0b235ecd4fa ("xhci: Refactor xhci_generic_setup code")
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D58465
sys/dev/usb/controller/xhci.c | 190 +++++++++++++++++++++++++++---------------
1 file changed, 121 insertions(+), 69 deletions(-)
--
You are receiving this mail because:
You are the assignee for the bug.