linux-kernel - [PATCH v3] usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250516033908.7386-1-shawn2000100@gmail.com>
Date: Fri, 16 May 2025 11:39:05 +0800
From: Jay Chen <shawn2000100@...il.com>
To: mathias.nyman@...el.com,
	gregkh@...uxfoundation.org
Cc: linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	jay.chen@...mens.com,
	Jay Chen <shawn2000100@...il.com>
Subject: [PATCH v3] usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command

According to the xHCI 1.2 spec (Section 6.2.3, p.454), the Average
TRB Length (avg_trb_len) for control endpoints should be set to 8.

Currently, during the Address Device Command, EP0's avg_trb_len remains 0,
which may cause some xHCI hardware to reject the Input Context, resulting
in device enumeration failures. In extreme cases, using a zero avg_trb_len
in calculations may lead to division-by-zero errors and unexpected system
crashes.

This patch sets avg_trb_len to 8 for EP0 in
xhci_setup_addressable_virt_dev(), ensuring compliance with the spec
and improving compatibility across various host controller implementations.

v3:
- Corrected author name in commit metadata and added changelog.

v2:
- Fixed malformed patch formatting issue pointed out by maintainer.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=220033
Signed-off-by: Jay Chen <shawn2000100@...il.com>
---
 drivers/usb/host/xhci-mem.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index d698095fc88d..fed9e9d1990c 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1166,6 +1166,8 @@ int xhci_setup_addressable_virt_dev(struct xhci_hcd *xhci, struct usb_device *ud
 	ep0_ctx->deq = cpu_to_le64(dev->eps[0].ring->first_seg->dma |
 				   dev->eps[0].ring->cycle_state);

+	ep0_ctx->tx_info |= cpu_to_le32(EP_AVG_TRB_LENGTH(8));
+
 	trace_xhci_setup_addressable_virt_device(dev);

 	/* Steps 7 and 8 were done in xhci_alloc_virt_device() */
-- 
2.43.5