From: Xu Rao <raoxu@uniontech.com>

xhci_create_rhub_port_array() is used for both USB2 and USB3
root hubs. The limit path always writes usb3_rhub.num_ports.

When the helper limits the USB2 root hub, this leaves the passed
root hub unchanged and modifies the wrong root hub instead.

Limit the root hub passed to the helper so the cap is applied to
the root hub currently being initialized.

Fixes: 9a7ad750a8fb ("usb: xhci: move roothub port limit validation")
Signed-off-by: Xu Rao <raoxu@uniontech.com>
---
 drivers/usb/host/xhci-mem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 997fe90f54e5..2545f96fd1ee 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2182,7 +2182,7 @@ static void xhci_create_rhub_port_array(struct xhci_hcd *xhci, struct xhci_hub *
 	 * descriptors aren't longer than the USB core will allocate.
 	 */
 	if (rhub->num_ports > max_ports) {
-		xhci->usb3_rhub.num_ports = max_ports;
+		rhub->num_ports = max_ports;
 		xhci_dbg_trace(xhci, trace_xhci_dbg_init, "Limiting USB%u root hub ports to %u",
 			       rhub->maj_rev, max_ports);
 	}
--
2.50.1

On Thu,  4 Jun 2026 11:48:18 +0800, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> xhci_create_rhub_port_array() is used for both USB2 and USB3
> root hubs. The limit path always writes usb3_rhub.num_ports.
> 
> When the helper limits the USB2 root hub, this leaves the passed
> root hub unchanged and modifies the wrong root hub instead.
> 
> Limit the root hub passed to the helper so the cap is applied to
> the root hub currently being initialized.
> 
> Fixes: 9a7ad750a8fb ("usb: xhci: move roothub port limit validation")
> Signed-off-by: Xu Rao <raoxu@uniontech.com>

Previous patch for the same bug, Cc its author and bad commit author.
https://lore.kernel.org/linux-usb/20260516033443.3646966-1-rollkingzzc@gmail.com/

I'm not sure how people keep discovering this issue - only by review
or are there really xHCI controllers with more than 31 USB 2.0 ports?
Should things be patched to support them properly?

Regards,
Michal

On Thu, Jun 04, 2026 at 08:51:36AM +0200, Michal Pecio wrote:

> Previous patch for the same bug, Cc its author and bad commit author.
> https://lore.kernel.org/linux-usb/20260516033443.3646966-1-rollkingzzc@gmail.com/
>
> I'm not sure how people keep discovering this issue - only by review
> or are there really xHCI controllers with more than 31 USB 2.0 ports?
> Should things be patched to support them properly?

Thanks for pointing this out.

I missed Zhang's earlier patch. My patch was based on reviewing commit
9a7ad750a8fb ("usb: xhci: move roothub port limit validation").

Before that refactoring, the USB2 and USB3 root hub port limits were
applied to the corresponding root hub directly. After the validation was
moved into xhci_create_rhub_port_array(), the helper receives the root
hub being initialized, but the limit path still updates
xhci->usb3_rhub.num_ports unconditionally. That changes the original
logic when the helper is called for the USB2 root hub.

So this was found by code review of that refactoring, not from a real
controller with more than 31 USB 2.0 root hub ports.

Thanks,
Xu Rao