USB: a device whose wTotalLength is 9 or less is asked for its configuration for ever #170

New Issue

2026-11-11T21:32:11Z

rajames commented

2026-11-11 21:32:11 +00:00

Found

kernel/src/usb/xhci.c:1343 classes a configuration request of length <= 9 as XHCI_XFER_CONFIG_DESC_SHORT. Its handler (line 2213) reads wTotalLength and asks again for that many bytes. A device reporting wTotalLength <= 9 gets a second request that is again SHORT, and so on: that slot never leaves enumeration. wTotalLength = 0 also issues a zero-length data stage. A broken or hostile device only.

Done when

A device (QEMU or a test double) reporting wTotalLength 9 and 0 is refused with a message, not looped on

🤖 Filed with Claude Code -- the code review of 2026-11-11, at 4d42d25c (Captain Bob, 2026-11-11: "File the review findings as issues"). Read, not run: each is to be confirmed by a test written first and seen to fail.

### Found `kernel/src/usb/xhci.c:1343` classes a configuration request of `length <= 9` as `XHCI_XFER_CONFIG_DESC_SHORT`. Its handler (line 2213) reads `wTotalLength` and asks again for that many bytes. A device reporting `wTotalLength <= 9` gets a second request that is again SHORT, and so on: that slot never leaves enumeration. `wTotalLength = 0` also issues a zero-length data stage. A broken or hostile device only. ### Done when - [ ] A device (QEMU or a test double) reporting wTotalLength 9 and 0 is refused with a message, not looped on 🤖 Filed with [Claude Code](https://claude.com/claude-code) -- the code review of 2026-11-11, at `4d42d25c` (Captain Bob, 2026-11-11: "File the review findings as issues"). Read, not run: each is to be confirmed by a test written first and seen to fail.

rajames added the area/kernel

labels 2026-11-11 21:32:13 +00:00

Sign in to join this conversation.