From nobody Mon Jul 27 05:31:52 2026 X-Original-To: bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h7nK41jfDz6mMh7 for ; Mon, 27 Jul 2026 05:31:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h7nK4135mz3tsr for ; Mon, 27 Jul 2026 05:31:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785130312; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=z/KuWix+2Ly+gUUx6Eb/xGt1454zZistULN0KEnWg3U=; b=h98TjbWQsyc6dtuBls4bL7slDMLwjS9uO0gTDLSX+UyK314QNdcPSgg+qa3Bx9ZKD96Hla 9xzSXT/VM6YukjazDWjBCi5T3r664+sC4CVAQratS9J2noYZP/Iu4gkneqJTSuPY41+6Kt /gkOJoY6QoSttZmHyQRS4neNIetis13Oj7aT/oZKwakP9+Ilv46gWjr1NLZAHZtVozIMZQ PEZKiAYkNDVpo6g6i03Pu+/mRdLmqwrjO0Y2XXXvnypb5mg0PHcYGNuGNbWK9AuabhpDD5 NvwRJwe+j43VwNXYLsU6orzvG0TT5TZ7R0sGnPV61e/+aFuIBT/ybkxItIg+ow== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785130312; a=rsa-sha256; cv=none; b=ys5AkxLb+Dmsjiz9lYKlKKnbBxeYfXuIsdV8/Ja69aQ7uhJmJgzVrak36YYa4R43WmbWD/ 50OzsfJhezi+C+urWy2kd2I9627lMijPxQpkSp7ogqXi5px56L0ZfegNx1Tqmwam3g+bZn gIaYHKVwxyN8eX7Id0BK4jl9DFQw7zxfFqZiboPqrTvXPb6zHTJgixLbnmgAImt8mCYTXh jzfeFnvRKKlLDZ6+J699SHs6ntMxLmCABFXGetWCxC0T73VEDoDiOExuOzO8pzwU8Alz5z 8Xcf+v0LJ86nIZEyKhgcFLjym6MW3yIchtsSZ3py2wXge1kTcVeF3Khw7RWDaQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785130312; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=z/KuWix+2Ly+gUUx6Eb/xGt1454zZistULN0KEnWg3U=; b=NZ+lulgzPj0ZlfRZJlyd31hisFMEX7PwK2e4R3bJKmbEP/4IdlX8vyAm8dvtuRN3+/5Hzx P+yj1UQqaNTIa74CgB3oqYRLJcZMTKvBEKJx23zuCYlRu/HtSCQjhR0p4IzcF7hnantUH/ F7xaDMKrSq6XCf4QcpmDPDW38xGwce1W5T4il7t1LQAQIOAbXB4hJ77qQEU5GV+pkNGcem GKWcMA0pqfocE1tyv4ju+J5zuy3rgVqCcuOWbepAT3e/uWc+0EEK7w/hGEvqeGEmfRZeda w8HjL214DfurDagLs9WntFP81GC1DhrpmDwAIv17ad6IM82PPjki/pG61S7Vdw== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4h7nK403f4zvgk for ; Mon, 27 Jul 2026 05:31:52 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 66R5Vpwo049266 for ; Mon, 27 Jul 2026 05:31:51 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from bugzilla@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 66R5Vpbe049265 for bugs@FreeBSD.org; Mon, 27 Jul 2026 05:31:51 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: bugzilla set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 297053] xhci(4): TRB-array memory corruption and kernel panic for bulk frames larger than 64 KiB Date: Mon, 27 Jul 2026 05:31:52 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 16.0-CURRENT X-Bugzilla-Keywords: crash, regression X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: commit-hook@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: bugs@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-bugs@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D297053 --- Comment #3 from commit-hook@FreeBSD.org --- A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3De3e56236bcae96a44dc47be5e3a7ffac3= 322b49f commit e3e56236bcae96a44dc47be5e3a7ffac3322b49f Author: ShengYi Hung AuthorDate: 2026-07-26 06:35:11 +0000 Commit: ShengYi Hung CommitDate: 2026-07-27 05:31:12 +0000 xhci: Fix packet xfer larger than 64kb Previously, multiple frames of xfers are split into many tds. In the refactor process, we forget to consider this. The td builder is already allocate with enough numbers of tds. What we need to do is to fill the normal trbs for muiltiple tds when building trbs. PR: 297053 Tested by: phk, oleglelchuk@gmail.com Fixes: e0b235ecd4fa ("xhci: Refactor xhci_generic_setup code") Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58465 sys/dev/usb/controller/xhci.c | 190 +++++++++++++++++++++++++++-----------= ---- 1 file changed, 121 insertions(+), 69 deletions(-) --=20 You are receiving this mail because: You are the assignee for the bug.=