* Forwarded: Re: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
2026-08-21 7:52 [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt syzbot
@ 2026-08-21 12:14 ` syzbot
2026-08-21 12:52 ` Forwarded: Re: [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt syzbot
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-08-21 12:14 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
Author: erdaitianjiao@gmail.com
#syz test
^ permalink raw reply [flat|nested] 7+ messages in thread* Forwarded: Re: [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt
2026-08-21 7:52 [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt syzbot
2026-08-21 12:14 ` Forwarded: Re: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup() syzbot
@ 2026-08-21 12:52 ` syzbot
2026-08-21 13:15 ` Forwarded: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup() syzbot
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-08-21 12:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt
Author: erdaitianjiao@gmail.com
#syz test
From f7f2199964ee2b4204aabd4d1190845f5ad1da62 Mon Sep 17 00:00:00 2001
From: erdaitianjiao <erdaitianjiao@gmail.com>
Date: Fri, 21 Aug 2026 19:07:10 +0800
Subject: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
xhci_hcd can be bound to arbitrary PCI devices via the
driver_override sysfs knob. When this happens to a device whose
MMIO registers are not xHCI capability registers,
xhci_gen_setup() reads CAPLENGTH from the foreign register
layout and uses it as a byte offset to compute op_regs.
A non-xHCI device can return a CAPLENGTH value that is
- not large enough to fit the capability register block, or
- not 4-byte aligned (e.g. the NVMe CAP register's low byte is
0xff, which becomes CAPLENGTH = 0xff).
The unaligned case is especially harmful on arm64: MMIO is
Device memory and Device-nGnRE accesses require natural
alignment, so readl(&op_regs->command) faults with an
alignment exception even when the address is within the
ioremapped region.
Validate CAPLENGTH in xhci_gen_setup() and fail probe with
-ENODEV if the value is smaller than 0x20 (capability registers
are 32 bytes per the xHCI spec), not 4-byte aligned, or leaves
no room for the operational register space within the mapped
region.
The run_regs_off read on the next line has the same shape, but
is not reachable on the xhci_halt code path and is left
untouched here.
Reproduced on a QEMU virt machine with a syzkaller repro that
unbinds the NVMe driver on 0000:00:02.0 and binds xhci_hcd via
driver_override. Before this patch the kernel Oopses and
panics; after, the probe is rejected cleanly (verified with 46
consecutive probe attempts, zero Oopses).
Reported-by: syzbot+c90273bf9017ef1462af@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=44c85514940262c7e2fad6f8fd0c07d8f2884154
Fixes: 552e0c4f12fe ("usb/xhci: move xhci_gen_setup() away from -pci.")
Signed-off-by: erdaitianjiao <erdaitianjiao@gmail.com>
---
drivers/usb/host/xhci.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 091c82ca8ee2..fb0075d0530f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -5432,7 +5432,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
*/
struct device *dev = hcd->self.sysdev;
int retval;
- u32 hcs_params1;
+ u32 hcs_params1, capbase;
/* Accept arbitrarily long scatter-gather lists */
hcd->self.sg_tablesize = ~0;
@@ -5453,8 +5453,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
mutex_init(&xhci->mutex);
xhci->main_hcd = hcd;
xhci->cap_regs = hcd->regs;
- xhci->op_regs = hcd->regs +
- HC_LENGTH(readl(&xhci->cap_regs->hc_capbase));
+ capbase = readl(&xhci->cap_regs->hc_capbase);
+ if (HC_LENGTH(capbase) < 0x20 ||
+ (HC_LENGTH(capbase) & 0x3) ||
+ (hcd->rsrc_len &&
+ HC_LENGTH(capbase) + sizeof(struct xhci_op_regs) > hcd->rsrc_len)) {
+ xhci_err(xhci, "Invalid CAPLENGTH %#x (rsrc_len %#lx)
",
+ HC_LENGTH(capbase), (unsigned long)hcd->rsrc_len);
+ return -ENODEV;
+ }
+ xhci->op_regs = hcd->regs + HC_LENGTH(capbase);
xhci->run_regs = hcd->regs +
(readl(&xhci->cap_regs->run_regs_off) & RTSOFF_MASK);
/* Cache read-only capability registers */
--
2.55.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Forwarded: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
2026-08-21 7:52 [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt syzbot
2026-08-21 12:14 ` Forwarded: Re: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup() syzbot
2026-08-21 12:52 ` Forwarded: Re: [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt syzbot
@ 2026-08-21 13:15 ` syzbot
2026-08-21 13:40 ` Forwarded: Re: #syz test (re-run after sandbox SYZFAIL) syzbot
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-08-21 13:15 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
Author: erdaitianjiao@gmail.com
#syz test
xhci_hcd can be bound to arbitrary PCI devices via the
driver_override sysfs knob. When this happens to a device whose
MMIO registers are not xHCI capability registers,
xhci_gen_setup() reads CAPLENGTH from the foreign register
layout and uses it as a byte offset to compute op_regs.
A non-xHCI device can return a CAPLENGTH value that is
- not large enough to fit the capability register block, or
- not 4-byte aligned (e.g. the NVMe CAP register's low byte is
0xff, which becomes CAPLENGTH = 0xff).
The unaligned case is especially harmful on arm64: MMIO is
Device memory and Device-nGnRE accesses require natural
alignment, so readl(&op_regs->command) faults with an
alignment exception even when the address is within the
ioremapped region.
Validate CAPLENGTH in xhci_gen_setup() and fail probe with
-ENODEV if the value is smaller than 0x20 (capability registers
are 32 bytes per the xHCI spec), not 4-byte aligned, or leaves
no room for the operational register space within the mapped
region.
The run_regs_off read on the next line has the same shape, but
is not reachable on the xhci_halt code path and is left
untouched here.
Reproduced on a QEMU virt machine with a syzkaller repro that
unbinds the NVMe driver on 0000:00:02.0 and binds xhci_hcd via
driver_override. Before this patch the kernel Oopses and
panics; after, the probe is rejected cleanly (verified with 46
consecutive probe attempts, zero Oopses).
Reported-by: syzbot+c90273bf9017ef1462af@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=44c85514940262c7e2fad6f8fd0c07d8f2884154
Fixes: 552e0c4f12fe ("usb/xhci: move xhci_gen_setup() away from -pci.")
Signed-off-by: erdaitianjiao <erdaitianjiao@gmail.com>
---
drivers/usb/host/xhci.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 091c82ca8ee2..fb0075d0530f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -5432,7 +5432,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
*/
struct device *dev = hcd->self.sysdev;
int retval;
- u32 hcs_params1;
+ u32 hcs_params1, capbase;
/* Accept arbitrarily long scatter-gather lists */
hcd->self.sg_tablesize = ~0;
@@ -5453,8 +5453,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
mutex_init(&xhci->mutex);
xhci->main_hcd = hcd;
xhci->cap_regs = hcd->regs;
- xhci->op_regs = hcd->regs +
- HC_LENGTH(readl(&xhci->cap_regs->hc_capbase));
+ capbase = readl(&xhci->cap_regs->hc_capbase);
+ if (HC_LENGTH(capbase) < 0x20 ||
+ (HC_LENGTH(capbase) & 0x3) ||
+ (hcd->rsrc_len &&
+ HC_LENGTH(capbase) + sizeof(struct xhci_op_regs) > hcd->rsrc_len)) {
+ xhci_err(xhci, "Invalid CAPLENGTH %#x (rsrc_len %#lx)\n",
+ HC_LENGTH(capbase), (unsigned long)hcd->rsrc_len);
+ return -ENODEV;
+ }
+ xhci->op_regs = hcd->regs + HC_LENGTH(capbase);
xhci->run_regs = hcd->regs +
(readl(&xhci->cap_regs->run_regs_off) & RTSOFF_MASK);
/* Cache read-only capability registers */
--
2.55.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Forwarded: Re: #syz test (re-run after sandbox SYZFAIL)
2026-08-21 7:52 [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt syzbot
` (2 preceding siblings ...)
2026-08-21 13:15 ` Forwarded: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup() syzbot
@ 2026-08-21 13:40 ` syzbot
2026-08-21 14:14 ` Forwarded: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup() syzbot
2026-08-21 15:34 ` syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-08-21 13:40 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Re: #syz test (re-run after sandbox SYZFAIL)
Author: erdaitianjiao@gmail.com
The previous run (job id 15d6fa25580000) failed with
SYZFAIL: posix_spawnp failed (errno 5: Input/output error)
but the kernel itself built and booted cleanly — no Oops / KASAN /
alignment fault from the xhci_halt path.
The crash is in the syzbot executor sandbox, not in the patch.
Please re-run using the patch you already have cached for this bug.
Thanks.
#syz test
^ permalink raw reply [flat|nested] 7+ messages in thread* Forwarded: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
2026-08-21 7:52 [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt syzbot
` (3 preceding siblings ...)
2026-08-21 13:40 ` Forwarded: Re: #syz test (re-run after sandbox SYZFAIL) syzbot
@ 2026-08-21 14:14 ` syzbot
2026-08-21 15:34 ` syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-08-21 14:14 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
Author: erdaitianjiao@gmail.com
#syz test
xhci_hcd can be bound to arbitrary PCI devices via the
driver_override sysfs knob. When this happens to a device whose
MMIO registers are not xHCI capability registers,
xhci_gen_setup() reads CAPLENGTH from the foreign register
layout and uses it as a byte offset to compute op_regs.
A non-xHCI device can return a CAPLENGTH value that is
- not large enough to fit the capability register block, or
- not 4-byte aligned (e.g. the NVMe CAP register's low byte is
0xff, which becomes CAPLENGTH = 0xff).
The unaligned case is especially harmful on arm64: MMIO is
Device memory and Device-nGnRE accesses require natural
alignment, so readl(&op_regs->command) faults with an
alignment exception even when the address is within the
ioremapped region.
Validate CAPLENGTH in xhci_gen_setup() and fail probe with
-ENODEV if the value is smaller than 0x20 (capability registers
are 32 bytes per the xHCI spec), not 4-byte aligned, or leaves
no room for the operational register space within the mapped
region.
The run_regs_off read on the next line has the same shape, but
is not reachable on the xhci_halt code path and is left
untouched here.
Reproduced on a QEMU virt machine with a syzkaller repro that
unbinds the NVMe driver on 0000:00:02.0 and binds xhci_hcd via
driver_override. Before this patch the kernel Oopses and
panics; after, the probe is rejected cleanly (verified with 46
consecutive probe attempts, zero Oopses).
Reported-by: syzbot+c90273bf9017ef1462af@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=44c85514940262c7e2fad6f8fd0c07d8f2884154
Fixes: 552e0c4f12fe ("usb/xhci: move xhci_gen_setup() away from -pci.")
Signed-off-by: erdaitianjiao <erdaitianjiao@gmail.com>
---
drivers/usb/host/xhci.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 091c82ca8ee2..fb0075d0530f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -5432,7 +5432,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
*/
struct device *dev = hcd->self.sysdev;
int retval;
- u32 hcs_params1;
+ u32 hcs_params1, capbase;
/* Accept arbitrarily long scatter-gather lists */
hcd->self.sg_tablesize = ~0;
@@ -5453,8 +5453,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
mutex_init(&xhci->mutex);
xhci->main_hcd = hcd;
xhci->cap_regs = hcd->regs;
- xhci->op_regs = hcd->regs +
- HC_LENGTH(readl(&xhci->cap_regs->hc_capbase));
+ capbase = readl(&xhci->cap_regs->hc_capbase);
+ if (HC_LENGTH(capbase) < 0x20 ||
+ (HC_LENGTH(capbase) & 0x3) ||
+ (hcd->rsrc_len &&
+ HC_LENGTH(capbase) + sizeof(struct xhci_op_regs) > hcd->rsrc_len)) {
+ xhci_err(xhci, "Invalid CAPLENGTH %#x (rsrc_len %#lx)\n",
+ HC_LENGTH(capbase), (unsigned long)hcd->rsrc_len);
+ return -ENODEV;
+ }
+ xhci->op_regs = hcd->regs + HC_LENGTH(capbase);
xhci->run_regs = hcd->regs +
(readl(&xhci->cap_regs->run_regs_off) & RTSOFF_MASK);
/* Cache read-only capability registers */
--
2.55.0
^ permalink raw reply related [flat|nested] 7+ messages in thread* Forwarded: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
2026-08-21 7:52 [syzbot] [usb?] BUG: unable to handle kernel paging request in xhci_halt syzbot
` (4 preceding siblings ...)
2026-08-21 14:14 ` Forwarded: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup() syzbot
@ 2026-08-21 15:34 ` syzbot
5 siblings, 0 replies; 7+ messages in thread
From: syzbot @ 2026-08-21 15:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] usb: xhci: validate CAPLENGTH in xhci_gen_setup()
Author: erdaitianjiao@gmail.com
#syz test
xhci_hcd can be bound to arbitrary PCI devices via the
driver_override sysfs knob. When this happens to a device whose
MMIO registers are not xHCI capability registers,
xhci_gen_setup() reads CAPLENGTH from the foreign register
layout and uses it as a byte offset to compute op_regs.
A non-xHCI device can return a CAPLENGTH value that is
- not large enough to fit the capability register block, or
- not 4-byte aligned (e.g. the NVMe CAP register's low byte is
0xff, which becomes CAPLENGTH = 0xff).
The unaligned case is especially harmful on arm64: MMIO is
Device memory and Device-nGnRE accesses require natural
alignment, so readl(&op_regs->command) faults with an
alignment exception even when the address is within the
ioremapped region.
Validate CAPLENGTH in xhci_gen_setup() and fail probe with
-ENODEV if the value is smaller than 0x20 (capability registers
are 32 bytes per the xHCI spec), not 4-byte aligned, or leaves
no room for the operational register space within the mapped
region.
The run_regs_off read on the next line has the same shape, but
is not reachable on the xhci_halt code path and is left
untouched here.
Reproduced on a QEMU virt machine with a syzkaller repro that
unbinds the NVMe driver on 0000:00:02.0 and binds xhci_hcd via
driver_override. Before this patch the kernel Oopses and
panics; after, the probe is rejected cleanly (verified with 46
consecutive probe attempts, zero Oopses).
Reported-by: syzbot+c90273bf9017ef1462af@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=44c85514940262c7e2fad6f8fd0c07d8f2884154
Fixes: 552e0c4f12fe ("usb/xhci: move xhci_gen_setup() away from -pci.")
Signed-off-by: erdaitianjiao <erdaitianjiao@gmail.com>
---
drivers/usb/host/xhci.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 091c82ca8ee2..fb0075d0530f 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -5432,7 +5432,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
*/
struct device *dev = hcd->self.sysdev;
int retval;
- u32 hcs_params1;
+ u32 hcs_params1, capbase;
/* Accept arbitrarily long scatter-gather lists */
hcd->self.sg_tablesize = ~0;
@@ -5453,8 +5453,16 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
mutex_init(&xhci->mutex);
xhci->main_hcd = hcd;
xhci->cap_regs = hcd->regs;
- xhci->op_regs = hcd->regs +
- HC_LENGTH(readl(&xhci->cap_regs->hc_capbase));
+ capbase = readl(&xhci->cap_regs->hc_capbase);
+ if (HC_LENGTH(capbase) < 0x20 ||
+ (HC_LENGTH(capbase) & 0x3) ||
+ (hcd->rsrc_len &&
+ HC_LENGTH(capbase) + sizeof(struct xhci_op_regs) > hcd->rsrc_len)) {
+ xhci_err(xhci, "Invalid CAPLENGTH %#x (rsrc_len %#lx)\n",
+ HC_LENGTH(capbase), (unsigned long)hcd->rsrc_len);
+ return -ENODEV;
+ }
+ xhci->op_regs = hcd->regs + HC_LENGTH(capbase);
xhci->run_regs = hcd->regs +
(readl(&xhci->cap_regs->run_regs_off) & RTSOFF_MASK);
/* Cache read-only capability registers */
--
2.55.0
^ permalink raw reply related [flat|nested] 7+ messages in thread