Re: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()

[Greg Kroah-Hartman]

On Sat, Aug 22, 2026 at 06:23:57PM +0800, erdaitianjiao wrote:
> xhci_hcd can be bound to arbitrary PCI devices via the
> driver_override sysfs knob. When this happens to a device whose
> MMIO registers are not xHCI capability registers,
> xhci_gen_setup() reads CAPLENGTH from the foreign register
> layout and uses it as a byte offset to compute op_regs.
> 
> A non-xHCI device can return a CAPLENGTH value that is
>   - not large enough to fit the capability register block, or
>   - not 4-byte aligned (e.g. the NVMe CAP register's low byte is
>     0xff, which becomes CAPLENGTH = 0xff).

That's crazy, and I'm getting tired of rejecting patches like this.
Again, if you use 'bind' to attach a device to a driver you HAVE to know
what you are doing.  Attempting to fix up each and every driver to
handle this is not ok, and will not happen.

sorry, syzbot is broken and needs to be fixed,

greg k-h