Re: [PATCH v2] xhci: fix lost bounce buffers on TDs spanning several ring segments

[Michal Pecio <michal.pecio@gmail.com>]

On Tue, 18 Aug 2026 10:29:41 +0300, Mathias Nyman wrote:
> On 8/18/26 01:48, Michal Pecio wrote: 
> > You have removed protection from infinite looping. I think nowadays
> > the driver has more loops without such protection and everytihng is
> > fine, but I'm not sure how it was in the past, and this patch goes
> > to stable.
> > 
> > Maybe let's see what Mathias thinks about it.  
> 
> Thanks for adding me back to the loop (cc)
> 
> The infinite loop risk could be prevented by using
> xhci_for_each_ring_seg():
> 
> xhci_for_each_ring_seg(td->start_seg, seg) {
> 	if (seg->bounce_len)
> 		xhci_unmap_one_bounce_buffer(xhci, ring, td, seg);
> 	if (seg == td->bounce_seg)
> 		break;
> }

That's tricky to backport; the macro doesn't exist in linux-6.6.y or
earlier and the commit which added it includes many other changes.

And it only prevents infinite loop if start_seg is reachable from
itself (so not if start_seg->next->next == start_seg->next). Similarly,
v2 is good enough as long as bounce_seg is reachable from start_seg.
It surely was reachable at the time of enqueue, so only a botched ring
expansion *later* could break this.

I actually think that chances of such bugs existing and being unnoticed
for years are practically zero, so maybe just don't worry about it.

I only mentioned it because:
- v1 included a safety counter checked against ring->num_segs
- it's something that people used to worry about a lot in the past
  for some reason; maybe just to aid debugging during development

Regards,
Michal