Re: [PATCH] usb: xhci: fix maximum event ring segments calculation

From: Mathias Nyman

Date: Mon Aug 31 2026 - 05:55:36 EST


Hi

On 8/28/26 13:59, oushixiong1025@xxxxxxx wrote:
From: Shixiong Ou <oushixiong@xxxxxxxxxx>

Commit 6d45e9556d4a ("usb: xhci: standardize multi bit-field macros")
converted BIT(HCS_ERST_MAX(hcs_params2)) into
FIELD_GET(HCS_ERST_MAX, hcs_params2) << 2. The ERST Max field is a
power-of-two exponent, so the maximum number of segments is 2^n, not
n * 4.

With an ERST Max of 0 (as reported by e.g. QEMU xHCI) max_segs becomes
0, the event ring is allocated with 0 segments, and the resulting
zero-sized ERST allocation trips the page allocator:

Thanks for the report and fix.

This issue was reported earlier and is address in:

https://lore.kernel.org/linux-usb/7e6648ad-7459-4248-8c6c-227cfc2586d8@xxxxxxxxxxxxxxx/

That patch is on its way upstream.

Good to get verification the fix (very similar) solves the issue for you as well.

Thanks
Mathias