Date: Thu, 10 Sep 2026 16:25:43 +0200
From: Michal Pecio <michal.pecio@gmail.com>
To: Sasha Levin <sashal@kernel.org>
Cc: stable@vger.kernel.org, Mathias Nyman <mathias.nyman@linux.intel.com>,
 Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Subject: Re: [PATCH 6.6.y 2/4] usb: xhci: Fix sum_trb_lengths()
Message-ID: <20260910162543.2d3894a4.michal.pecio@gmail.com>
In-Reply-To: <20260910110830.4144529-2-sashal@kernel.org>
References: <2026090811-curler-hatchet-10b9@gregkh>
	<20260910110830.4144529-1-sashal@kernel.org>
	<20260910110830.4144529-2-sashal@kernel.org>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Thu, 10 Sep 2026 07:08:28 -0400, Sasha Levin wrote:
> From: Michal Pecio <michal.pecio@gmail.com>
> 
> [ Upstream commit ae71f9b88e5a15fed17a432e21c30ee9463ed1a4 ]
> 
> This function is supposed to sum the lengths of all transfer TRBs in
> a TD up to a point, but it starts summing at the current dequeue since
> it only ever gets called on the first pending TD.
> 
> This won't work when there are cancelled TDs at the beginning of the
> ring. The function tries to exclude No-Ops from the count, but not all
> cancelled TDs are No-Op'ed - not those the HW stopped on.
> 
> The absolutely obvious fix is to start counting at the TD's first TRB.
> And remove the now-useless 'ring' parameter, and 'xhci' too.
> 
> Signed-off-by: Michal Pecio <michal.pecio@gmail.com>
> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
> Link: https://lore.kernel.org/r/20241106101459.775897-4-mathias.nyman@linux.intel.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Stable-dep-of: ff44dfb03a29 ("xhci: fix lost bounce buffers on TDs spanning several ring segments")
> Signed-off-by: Sasha Levin <sashal@kernel.org>

grep Stable-dep-of -r Documentation/process comes empty,
is this tag supposed to mean what it seems to mean?

If so, I don't think it's true.

Regards,
Michal