[PATCH] usb: xhci: fix DMA address corruption in abort_td

[ANANDHAKRISHNAN S]

On Tue, Jan 20, 2026 at 23:43:46 +0100, Marek Vasut wrote:

> reset_ep() seems to have the same problem ?

Yes,it follows the same pattern of OR-ing the cycle state into the virtual 
enqueue pointer before translation. I’ll audit that path and include a 
corresponding fix so the cycle bit is applied only after converting to 
a DMA address, consistent with the change here.

> cycle_state is already either 0 or 1, isn't it ?

Yes, `ring->cycle_state` is indeed either 0 or 1. The intent of the explicit
masking was to make it clear that the cycle bit is applied only to the
*physical* address returned by xhci_trb_virt_to_dma(), and not to the
virtual TRB pointer itself, which was the root cause of the corruption.
I agree this can be simplified stylistically, and I can fold it into a
more compact expression in a v2.

I’m happy to change this to:

    addr = (addr & ~0x1ULL) | ring->cycle_state;

I’ll send a v2 addressing both points.

Thanks,
Anandhakrishnan S