Re: [PATCH 1/5] usb: xhci: Handle bogus TRB pointers in Missed Service Error events

[Mathias Nyman <mathias.nyman@linux.intel.com>]

On 8/4/26 13:02, Michal Pecio wrote:
> xHCI 1.0 allowed these pointers to be zero. Some Intel chipsets from the
> era usually set it to zero, but sometimes (apparently) to the next TRB
> after the one referenced by the previous transfer event on the endpoint.
> 
> Usually that's indeed the missed TD, but it may also be the last TRB of
> a two-TRB TD already completed with Short Packet on its first TRB. Then
> the driver skips all pending TDs, failing to find a match.
> 
> When handling Missed Service Error, scan TD list twice and only really
> skip TDs in the second pass if the first pass found a match. This won't
> catch bogus pointers to wrong TDs, but such a bug would be practically
> impossible to detect automatically and isn't known to exist.
> 
> Reported-by: Bart Nagel <bart@tremby.net>
> Closes: https://lore.kernel.org/linux-usb/al_hchyOdPoPWKEo@spiral/
> Suggested-by: Mathias Nyman <mathias.nyman@linux.intel.com>
> Fixes: d0b619599e52 ("usb: xhci: Expedite skipping missed isoch TDs on modern HCs")
> Cc: stable@vger.kernel.org
> Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
> ---

Thanks, I'll send this [PATCH 1/5] forward to 7.3 with rest of patches in for-usb-next

-Mathias