Re: [BUG] drivers/usb: out-of-bounds in xhci_queue_bulk_tx()

[Michal Pecio]

On Thu, 27 Aug 2026 12:43:58 +0000, co wrote:
> We found a bug reachable in:
> 
>     path    drivers/usb/host
>     crash   out-of-bounds in xhci_queue_bulk_tx()
>     commit  bd5f485f3f02 ("Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you patch the bug based on our artifacts, a tag would be
>     appreciated:
> 
> Reported-by: co+fd80bc5967eb22c3@xxxxxxx
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an LLM-generated root-cause analysis and a candidate
>     patch. The patch passes an A/B test: the same reproducer panics the
>     unpatched kernel and runs clean on the patched one. Neither has had
>     human review, so both still require validation before you send or
>     apply them. Available on:
> 
>         patch.diff  https://bugs.sh/b/fd80bc5967eb22c3/patch.diff
>         report.md   https://bugs.sh/b/fd80bc5967eb22c3/report.md

I for one have clicked that random web link, the patch boils down to

-       max_pkt = xhci_usb_endpoint_maxp(urb->dev, urb->ep);
+       max_pkt = ring->bounce_buf_len;

and sure, xhci_usb_endpoint_maxp() returns the "raw" out of spec value
from the descriptor, while bounce_buf_len is "sanitized", which means a
constant value of 512 for high-speed devices, since the driver doesn't
actually use out of spec max packet sizes on bulk endpoints (except for
SuperSpeed?), see xhci_endpoint_init().

The sanitized value is used to size bounce buffers and also programmed
into the HW, so it would make sense to use it here too.

And if anyone wonders how such a descriptor can reach HCDs,

  fb5ee84ea72c USB: Accept bulk endpoints with 1024-byte maxpacket

So this kind of weird device (no idea what they are) plus bad luck with
its driver submitting scatter-gather URBs could result in a bad day.

Regards,
Michal