Date: Mon, 27 Jul 2026 05:31:52 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 297053] xhci(4): TRB-array memory corruption and kernel panic for bulk frames larger than 64 KiB Message-ID: <bug-297053-227-9GAeGfmdjM@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-297053-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | previous in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297053 --- Comment #3 from commit-hook@FreeBSD.org --- A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=e3e56236bcae96a44dc47be5e3a7ffac3322b49f commit e3e56236bcae96a44dc47be5e3a7ffac3322b49f Author: ShengYi Hung <aokblast@FreeBSD.org> AuthorDate: 2026-07-26 06:35:11 +0000 Commit: ShengYi Hung <aokblast@FreeBSD.org> CommitDate: 2026-07-27 05:31:12 +0000 xhci: Fix packet xfer larger than 64kb Previously, multiple frames of xfers are split into many tds. In the refactor process, we forget to consider this. The td builder is already allocate with enough numbers of tds. What we need to do is to fill the normal trbs for muiltiple tds when building trbs. PR: 297053 Tested by: phk, oleglelchuk@gmail.com Fixes: e0b235ecd4fa ("xhci: Refactor xhci_generic_setup code") Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58465 sys/dev/usb/controller/xhci.c | 190 +++++++++++++++++++++++++++--------------- 1 file changed, 121 insertions(+), 69 deletions(-) -- You are receiving this mail because: You are the assignee for the bug.home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-297053-227-9GAeGfmdjM>