Re: [PATCH 11/22] usb: host: fix a few spelling mistakes in comments

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] usb: xhci: shift-out-of-bounds in xhci_endpoint_init() [1]
--

commit a988b8e7693dc7d03153a0ed5cd6c269e329c0d7
Author: Shunbo Shi <shishunbo@cmss.chinamobile.com>

usb: host: fix a few spelling mistakes in comments

This commit fixes spelling mistakes in comments across several USB host
controller drivers.

[ ... ]

> diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
> index 75577f441cddc..d92d6a95264b0 100644
> --- a/drivers/usb/host/xhci-mem.c
> +++ b/drivers/usb/host/xhci-mem.c
> @@ -1442,7 +1442,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
>  
>  	/*
>  	 * Get values to fill the endpoint context, mostly from ep descriptor.
> -	 * The average TRB buffer lengt for bulk endpoints is unclear as we
> +	 * The average TRB buffer length for bulk endpoints is unclear as we
>  	 * have no clue on scatter gather list entry size. For Isoc and Int,
>  	 * set it to max available. See xHCI 1.1 spec 4.14.1.1 for details.
>  	 */

[Severity: Medium]
This problem wasn't introduced by this patch, but can a full-speed bulk
endpoint with wMaxPacketSize of 0 trigger a shift-out-of-bounds in
rounddown_pow_of_two() further down in xhci_endpoint_init() [1]?

drivers/usb/host/xhci-mem.c:xhci_endpoint_init() {
	...
	max_packet = xhci_usb_endpoint_maxp(udev, ep);
	...
	if (usb_endpoint_xfer_bulk(&ep->desc)) {
		if (udev->speed == USB_SPEED_HIGH)
			max_packet = 512;
		if (udev->speed == USB_SPEED_FULL) {
			max_packet = rounddown_pow_of_two(max_packet);
			max_packet = clamp_val(max_packet, 8, 64);
		}
	}
	...
}

usb_parse_endpoint() logs a notice when wMaxPacketSize is 0 without rejecting
the descriptor. When xhci_endpoint_init() runs on such an endpoint,
max_packet is 0 and rounddown_pow_of_two(0) evaluates 1UL << -1 before
clamp_val() runs, triggering a UBSAN shift-out-of-bounds warning and
producing an architecture-dependent max_packet value. Clamping max_packet
before calling rounddown_pow_of_two() would avoid this.

[1] https://sashiko.dev/#/bug/linux-8c242134-4dc4-4170-867f-fb3afd236e9c

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110064105.20335-1-shishunbo@cmss.chinamobile.com?part=11