Fix xHCI heap corruption: allocate the Output Device Context full size at Address Device, never swap it (found at O-C)

Browse Source

xhci_cmd_address_device() sized the Output Device Context for Slot + EP0
(64 bytes); xhci_cmd_configure_endpoint() then allocated a bigger copy and
repointed DCBAA[slot_id]. The controller keeps the address it was given at
Address Device (QEMU caches it), so every bulk Endpoint Context was written
past the 64-byte block into the next kmalloc header -- on every USB
mass-storage attach, every ISA. After O-C's smoke campaign reshuffled the
heap, a kfree at thumbdrive unplug walked into it: #GP in coalesce_neighbors().

Found with temporary instrumentation (load base, code bytes at RIP, event
crumbs, a heap-list checker): the corrupt word was an EP Context (Bulk IN,
Running, MPS 1024) exactly DCI 3 x 32 bytes into the 64-byte context.

Now: XHCI_DEVICE_CTX_BYTES (32 contexts x 32 bytes) allocated once per
slot at Address Device, zeroed whole, never reallocated; Configure
Endpoint just fills it. Also ends the per-attach leak of the old context.

Verified: heap checker clean from boot; campaign -> O-A -> MINT -> unplug
-> re-attach passes with 0 exceptions; 3-ISA acceptance passes, parity and
dict_hash set unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

...

This commit is contained in:

Robert Allan James

2026-09-25 10:57:43 -04:00

co-authored by Claude Opus 5.5

parent ee4c401d1c

commit df150e8626

28 changed files with 110993 additions and 24 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

logs/20260925-013706/amd64/qemu-amd64-20260925-013706.log

+9288

File diff suppressed because one or more lines are too long

logs/20260925-025933/amd64/qemu-amd64-20260925-025933.log

+9146

File diff suppressed because it is too large Load Diff

logs/20260925-041213/amd64/qemu-amd64-20260925-041213.log

+9427

File diff suppressed because it is too large Load Diff

logs/20260925-043257/amd64/qemu-amd64-20260925-043257.log

+9281

File diff suppressed because one or more lines are too long

logs/20260925-055533/amd64/qemu-amd64-20260925-055533.log

+9347

File diff suppressed because one or more lines are too long

logs/20260925-071858/amd64/qemu-amd64-20260925-071858.log

+9341

File diff suppressed because one or more lines are too long

logs/20260925-084150/amd64/qemu-amd64-20260925-084150.log

+9155

File diff suppressed because one or more lines are too long

logs/20260925-084728/amd64/qemu-amd64-20260925-084728.log

+9126

File diff suppressed because it is too large Load Diff

logs/20260925-090302/amd64/qemu-amd64-20260925-090302.log

+9282

File diff suppressed because one or more lines are too long

logs/20260925-101854/amd64/qemu-amd64-20260925-101854.log

+9146

File diff suppressed because it is too large Load Diff

logs/20260925-103145/aarch64/qemu-aarch64-20260925-103145.log

+9118

File diff suppressed because it is too large Load Diff

logs/20260925-104448/riscv64/qemu-riscv64-20260925-104448.log

+9190

File diff suppressed because it is too large Load Diff