Re: [BUG] drivers/usb: out-of-bounds in xhci_queue_bulk_tx()

[Xiang Mei]

Th

On Thu, Aug 27, 2026 at 5:50 AM Greg Kroah-Hartman
<gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> On Thu, Aug 27, 2026 at 12:43:58PM +0000, co wrote:
> > We found a bug reachable in:
> >
> >     path    drivers/usb/host
> >     crash   out-of-bounds in xhci_queue_bulk_tx()
> >     commit  bd5f485f3f02 ("Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc")
> >
> > Config, environment, the sanitizer report and a C reproducer follow.
> >
> > == Notes ===============================================================
> >     If you patch the bug based on our artifacts, a tag would be
> >     appreciated:
> >
> > Reported-by: co+fd80bc5967eb22c3@xxxxxxx
> >
> >     Everything in this mail is validated by the reproducer below.
> >
> >     We also hold an LLM-generated root-cause analysis and a candidate
> >     patch. The patch passes an A/B test: the same reproducer panics the
> >     unpatched kernel and runs clean on the patched one. Neither has had
> >     human review, so both still require validation before you send or
> >     apply them. Available on:
> >
> >         patch.diff  https://bugs.sh/b/fd80bc5967eb22c3/patch.diff
> >         report.md   https://bugs.sh/b/fd80bc5967eb22c3/report.md
>
> Please validate and ensure that this is correct before sending this to
> us.  No need for us to dig through random web links, right?
>
Thanks for your feedback, Greg.

We are working on making reports public. Sorry for the inconvenience.
We'll stop sending bug reports before we fix the issue.

Xiang

> thanks,
>
> greg k-h
>