Re: [BUG] drivers/usb: out-of-bounds in xhci_queue_bulk_tx()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Thu, Aug 27, 2026 at 12:43:58PM +0000, co wrote:
> We found a bug reachable in:
> 
>     path    drivers/usb/host
>     crash   out-of-bounds in xhci_queue_bulk_tx()
>     commit  bd5f485f3f02 ("Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you patch the bug based on our artifacts, a tag would be
>     appreciated:
> 
> Reported-by: co+fd80bc5967eb22c3@bugs.sh
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an LLM-generated root-cause analysis and a candidate
>     patch. The patch passes an A/B test: the same reproducer panics the
>     unpatched kernel and runs clean on the patched one. Neither has had
>     human review, so both still require validation before you send or
>     apply them. Available on:
> 
>         patch.diff  https://bugs.sh/b/fd80bc5967eb22c3/patch.diff
>         report.md   https://bugs.sh/b/fd80bc5967eb22c3/report.md

Please validate and ensure that this is correct before sending this to
us.  No need for us to dig through random web links, right?

thanks,

greg k-h