Re: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()

[Greg Kroah-Hartman]

On Sat, Aug 22, 2026 at 06:23:57PM +0800, erdaitianjiao wrote:
> xhci_hcd can be bound to arbitrary PCI devices via the
> driver_override sysfs knob. When this happens to a device whose
> MMIO registers are not xHCI capability registers,
> xhci_gen_setup() reads CAPLENGTH from the foreign register
> layout and uses it as a byte offset to compute op_regs.
> 
> A non-xHCI device can return a CAPLENGTH value that is
>   - not large enough to fit the capability register block, or
>   - not 4-byte aligned (e.g. the NVMe CAP register's low byte is
>     0xff, which becomes CAPLENGTH = 0xff).
> 
> The unaligned case is especially harmful on arm64: MMIO is
> Device memory and Device-nGnRE accesses require natural
> alignment, so readl(&op_regs->command) faults with an
> alignment exception even when the address is within the
> ioremapped region.
> 
> Validate CAPLENGTH in xhci_gen_setup() and fail probe with
> -ENODEV if the value is smaller than 0x20 (capability registers
> are 32 bytes per the xHCI spec), not 4-byte aligned, or leaves
> no room for the operational register space within the mapped
> region.
> 
> The run_regs_off read on the next line has the same shape, but
> is not reachable on the xhci_halt code path and is left
> untouched here.
> 
> Reproduced on a QEMU virt machine with a syzkaller repro that
> unbinds the NVMe driver on 0000:00:02.0 and binds xhci_hcd via
> driver_override. Before this patch the kernel Oopses and
> panics; after, the probe is rejected cleanly. Ran the repro for
> over two hours (66,709 consecutive probe attempts) with zero
> Oopses.
> 
> Reported-by: syzbot+c90273bf9017ef1462af@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?id=44c85514940262c7e2fad6f8fd0c07d8f2884154
> Fixes: 552e0c4f12fe ("usb/xhci: move xhci_gen_setup() away from -pci.")
> Signed-off-by: erdaitianjiao <erdaitianjiao@xxxxxxxxx>
> ---
>  drivers/usb/host/xhci.c | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- It looks like you did not use your "real" name for the patch on either
  the Signed-off-by: line, or the From: line (both of which have to
  match).  Please read the kernel file,
  Documentation/process/submitting-patches.rst for how to do this
  correctly.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot