linux-kernel - [PATCH] usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <JH0PR06MB7294E46B393F1CA5FE0EE4F78396A@JH0PR06MB7294.apcprd06.prod.outlook.com>
Date: Tue, 13 May 2025 09:07:00 +0000
From: "Chen, Jay" <jay.chen@...mens.com>
To: "mathias.nyman@...el.com" <mathias.nyman@...el.com>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC: "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Shao, Tzi
 Yang" <tziyang.shao@...mens.com>
Subject: [PATCH] usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device

From fef893bcf0add89795b85bcc1f6bdae537f1dabe Mon Sep 17 00:00:00 2001
From: "jay.chen" <jay.chen@...mens.com>
Date: Tue, 13 May 2025 15:03:44 +0800
Subject: [PATCH] usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device
Command

According to the xHCI 1.2 spec (Section 6.2.3, p.454), the Average
TRB Length (avg_trb_len) for control endpoints should be set to 8.

Currently, during the Address Device Command, EP0's avg_trb_len remains 0,
which may cause some xHCI hardware to reject the Input Context, resulting
in device enumeration failures. In extreme cases, using a zero avg_trb_len
in calculations may lead to division-by-zero errors and unexpected system
crashes.

This patch sets avg_trb_len to 8 for EP0 in
xhci_setup_addressable_virt_dev(), ensuring compliance with the spec
and improving compatibility across various host controller implementations.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220033
Signed-off-by: jay.chen <jay.chen@...mens.com>
---
drivers/usb/host/xhci-mem.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index d698095fc88d..fed9e9d1990c 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1166,6 +1166,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
      ep0_ctx->deq = cpu_to_le64(dev->eps[0].ring->first_seg->dma |
                                 dev->eps[0].ring->cycle_state);

+      ep0_ctx->tx_info |= cpu_to_le32(EP_AVG_TRB_LENGTH(8));
+
      trace_xhci_setup_addressable_virt_device(dev);

       /* Steps 7 and 8 were done in xhci_alloc_virt_device() */
-- 
2.43.5