Re: [PATCH] usb: xhci: fix EP0 context leak on virt device allocation failure

[Neronin, Niklas]

On 17/10/2026 14.11, Anfernee Cao wrote:
> When XHCI_EP_LIMIT_QUIRK is set, xhci_alloc_dev() reserves an endpoint
> context for the default control endpoint before allocating the virt
> device:
> 
> 	ret = xhci_reserve_host_control_ep_resources(xhci);
> 	...
> 	if (!xhci_alloc_virt_device(xhci, slot_id, udev, GFP_NOIO))
> 		goto disable_slot;
> 
> The reservation is normally released by xhci_handle_cmd_disable_slot(),
> which calls xhci_free_device_endpoint_resources() for the virt device
> found at xhci->devs[slot_id].  xhci_alloc_virt_device() does not install
> the virt device when it fails, so the Disable Slot completion handler
> finds an empty slot, returns early, and the reserved context is never
> released.
> 
> Each failure leaks one endpoint context.  Once num_active_eps reaches
> limit_active_eps, every new device is rejected with "Not enough host
> resources" and cannot be enumerated.
> 
> Fix this by releasing the reservation when xhci_alloc_virt_device()
> fails.
> 
> Fixes: 2cf95c18d506 ("Intel xhci: Limit number of active endpoints to 64.")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Anfernee Cao <anferneemelokc5@xxxxxxxxx>
> ---
>  drivers/usb/host/xhci.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
> index 7f7babe9d681..8b9a6f88cca5 100644
> --- a/drivers/usb/host/xhci.c
> +++ b/drivers/usb/host/xhci.c
> @@ -4278,6 +4278,15 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
>  	 */
>  	if (!xhci_alloc_virt_device(xhci, slot_id, udev, GFP_NOIO)) {
>  		xhci_warn(xhci, "Could not allocate xHCI USB device data structures\n");
> +		/*
> +		 * The virt device was not installed, so the Disable Slot
> +		 * completion handler cannot drop the EP0 context reservation.
> +		 */
> +		if (xhci->quirks & XHCI_EP_LIMIT_QUIRK) {
> +			spin_lock_irqsave(&xhci->lock, flags);
> +			xhci->num_active_eps--;
> +			spin_unlock_irqrestore(&xhci->lock, flags);
> +		}
>  		goto disable_slot;
>  	}
>  	vdev = xhci->devs[slot_id];

Hi,

Thanks for working on this. I believe this is the same issue addressed in this patch:

https://lore.kernel.org/linux-usb/20261006152427.3735383-3-niklas.neronin@xxxxxxxxxxxxxxx/

Thanks,
Niklas