[PATCH] usb: xhci: fix DMA address corruption in abort_td

[Marek Vasut]

On 1/21/26 9:50 AM, ANANDHAKRISHNAN S wrote:
> On Tue, Jan 20, 2026 at 23:43:46 +0100, Marek Vasut wrote:
> 
>> reset_ep() seems to have the same problem ?
> 
> Yes,it follows the same pattern of OR-ing the cycle state into the virtual
> enqueue pointer before translation. I’ll audit that path and include a
> corresponding fix so the cycle bit is applied only after converting to
> a DMA address, consistent with the change here.
> 
>> cycle_state is already either 0 or 1, isn't it ?
> 
> Yes, `ring->cycle_state` is indeed either 0 or 1. The intent of the explicit
> masking was to make it clear that the cycle bit is applied only to the
> *physical* address returned by xhci_trb_virt_to_dma(), and not to the
> virtual TRB pointer itself, which was the root cause of the corruption.
> I agree this can be simplified stylistically, and I can fold it into a
> more compact expression in a v2.
> 
> I’m happy to change this to:
> 
>      addr = (addr & ~0x1ULL) | ring->cycle_state;
> 
> I’ll send a v2 addressing both points.
Please do a V2, thanks !

Also, please CC Mattijs for V2.