Re: [BUG] drivers/usb: out-of-bounds in xhci_queue_bulk_tx()

[Greg KH <greg@kroah.com>]

On Fri, Aug 28, 2026 at 02:00:17AM +0000, CO wrote:
> On Thu, Aug 27, 2026 at 10:31 AM Xiang Mei <xmei5@asu.edu> wrote:
> >
> > Th
> >
> > On Thu, Aug 27, 2026 at 5:50 AM Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Thu, Aug 27, 2026 at 12:43:58PM +0000, co wrote:
> > > > We found a bug reachable in:
> > > >
> > > >     path    drivers/usb/host
> > > >     crash   out-of-bounds in xhci_queue_bulk_tx()
> > > >     commit  bd5f485f3f02 ("Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc")
> > > >
> > > > Config, environment, the sanitizer report and a C reproducer follow.
> > > >
> > > > == Notes ===============================================================
> > > >     If you patch the bug based on our artifacts, a tag would be
> > > >     appreciated:
> > > >
> > > > Reported-by: co+fd80bc5967eb22c3@bugs.sh
> > > >
> > > >     Everything in this mail is validated by the reproducer below.
> > > >
> > > >     We also hold an LLM-generated root-cause analysis and a candidate
> > > >     patch. The patch passes an A/B test: the same reproducer panics the
> > > >     unpatched kernel and runs clean on the patched one. Neither has had
> > > >     human review, so both still require validation before you send or
> > > >     apply them. Available on:
> > > >
> > > >         patch.diff  https://bugs.sh/b/fd80bc5967eb22c3/patch.diff
> > > >         report.md   https://bugs.sh/b/fd80bc5967eb22c3/report.md
> > >
> > > Please validate and ensure that this is correct before sending this to
> > > us.  No need for us to dig through random web links, right?
> Hi Greg,
> 
> Thanks for the feedback, and sorry for the noise. Sending these before
> we had settled the format and talked to maintainers was our mistake.
> 
> Let me make sure we understood your suggestions.
> 
> # What we understood
> 
> You want patches that a human has verified, and you do not want to
> have to follow links to find out what a report says. We should not
> have sent what we sent.

That is correct, would you want anything different if we were to send
stuff to you?

> # Until then
> 
> We have stopped. No further reports go out until the format is one
> that does not waste your time. 19 reports went out in a single batch
> without a person releasing them, which was our process failure.
> That is fixed, and we would rather settle the format with you before
> we start again.

Just use our normal development process of sending patches, there's no
need to change anything here as it's working quite well (fastest rate of
change of any project with the most contributors...)

thanks,

greg k-h