Tianocore/edk2.git/MdeModulePkg/Bus/Usb, branch dependabot/github_actions/github/codeql-action-4.39.1

MdeModulePkg/UsbBusDxe: Free BOS buffer on read failure

2026-10-21T21:53:42+00:00

UsbGetDevBosDesc() allocates a buffer for the initial BOS descriptor request. If that request fails, the success-only cleanup is skipped and the function returns without freeing the buffer. Repeated enumeration attempts can leak one allocation per failure. Free the initial buffer before returning the transfer error. The leaking retrieval helper was introduced by PR #12714: https://github.com/tianocore/edk2/pull/12714 Signed-off-by: Michael D Kinney

MdeModulePkg/UsbBusDxe: Bound BOS capability parsing

2026-10-21T21:53:42+00:00

UsbIsSSDevice() trusts device-reported NumDeviceCaps and capability Length fields without bounding reads to the BOS buffer. Malformed values can cause out-of-bounds reads and an exception during device enumeration. Validate the BOS header and total length. Before reading each capability, check that its header and declared length fit in the remaining bytes. Reject malformed or truncated descriptors and recognize SuperSpeed only after validating the complete capability list. The unbounded parser was introduced by PR #12714: https://github.com/tianocore/edk2/pull/12714 Signed-off-by: Michael D Kinney

MdeModulePkg/UsbBusDxe: Guard descriptor on SS retry

2026-10-21T21:53:42+00:00

UsbEnumerateNewDev() frees DevDesc before resetting the port for an enumeration retry. UsbRootHubResetPort() scans that device during the reset and previously dereferenced DevDesc without checking it. For a SuperSpeed-capable device running below SuperSpeed, IsSSDev and Speed still satisfy the scan's preceding conditions after DevDesc is cleared. The DeviceClass access can therefore cause a null-pointer exception. Add descriptor checks before those dereferences and clear IsSSDev when freeing the descriptor. The unsafe reset dereference was introduced by PR #12714: https://github.com/tianocore/edk2/pull/12714 Signed-off-by: Michael D Kinney

MdeModulePkg/UsbBusDxe: Add GoogleTest coverage

2026-10-21T21:53:42+00:00

Test valid SuperSpeed recognition and reject capabilities extending beyond the BOS total length or supplied buffer. Verify failed initial BOS reads free their buffers and root-hub reset succeeds after descriptor cleanup. Signed-off-by: Michael D Kinney

MdeModulePkg/UsbMassStorageDxe: Report blank optical media as media absent

2026-10-21T04:58:42+00:00

A blank (unwritten) optical disc reports a zero capacity through READ CAPACITY (LastBlock == 0). The driver currently exposes such a device with BlockSize 2048 and LastBlock 0, so upper layers such as PartitionDxe and the BDS removable-media boot probe keep reading LBA 0. The drive rejects the read with "Illegal Request / LBA out of range" (sense 5/21/0) and UsbMassReadBlocks enters its reset recovery loop. So each failed probe can block for tens of seconds and boot appears to hang. Treat an optical device with zero capacity as media absent so that the media is skipped instead of being probed. Signed-off-by: Haword

MdeModulePkg/UsbBusDxe: Raise TPL to CALLBACK for wanted UsbIo connect

2026-09-21T06:06:06+00:00

Raise TPL to TPL_CALLBACK around the ConnectController() call in UsbBusRecursivelyConnectWantedUsbIo() and restore the original TPL afterward. UsbBusRecursivelyConnectWantedUsbIo() is normally reached through the DriverBinding Start routine invoked by gBS->ConnectController(), which runs at TPL_APPLICATION. While the wanted UsbIo handle is being connected, the USB device can be removed. The device removal polling event in UsbBus runs at TPL_CALLBACK. If the connect runs at TPL_APPLICATION, that event can preempt the connection and cause commands to be sent to a stale or non-existent USB device address, producing a lot of timeout transfers. This differs from UsbConnectDriver(), which is called from the enumeration polling event (XHCI async event) and is usually already at TPL_CALLBACK or TPL_NOTIFY. That function uses RestoreTPL()/ RaiseTPL() to ensure ConnectController() runs at TPL_CALLBACK. Signed-off-by: Marlboro_Chuang

MdeModulePkg/UsbBusDxe: Handle a quirk in Interface descriptor

2026-09-21T04:54:36+00:00

Some specific device requires a quirk in the Interface descriptor for InterfaceNumber to work properly [Suggested Solution] Implement the mechanism to ensure the first InterfaceNumber not equal to zero. Signed-off-by: Marlboro_Chuang

MdeModulePkg/UsbBusDxe: Fix UsbPortReset might run into recursive loop

2026-07-31T10:54:54+00:00

UsbSelectConfig will introduce the UsbConnectDriver call. If this UsbPortReset is happened in the Usb device driver Start() routine and the device FW can not be recovered by PortReset, the UsbSelectConfig will introduce the recursive loop. [Suggested solution] Since UsbPortReset should not change the Bus Topology, the Reset flow should only SetAddress and reconfigure the device. Signed-off-by: Marlboro Chuang Signed-off-by: Jared Pan

MdeModulePkg/UsbBusDxe: BOS Descriptor Check for SS Devices

2026-07-22T07:25:57+00:00

Some SuperSpeed-capable devices may fall back to High-Speed mode and cause subsequent commands to fail. [Suggested Solution] Check the BOS descriptor to verify SuperSpeed support and trigger a port reset if needed to re-enumerate the device properly. Signed-off-by: Marlboro Chuang Signed-off-by: Jared Pan

MdeModulePkg/UsbBusPei: Use dynamic buffer for USB configuration data

2026-07-21T03:50:20+00:00

USB devices whose configuration descriptor TotalLength exceeds 1024 bytes (e.g. IR cameras with large descriptor tables) previously hit an EFI_DEVICE_ERROR hard-limit and failed to enumerate in PEI. Replace the fixed array with a UINT8 * pointer and dynamically allocate the exact amount of memory required via PeiServicesAllocatePool() after the TotalLength is learned from the initial 4-byte descriptor probe. Signed-off-by: Damien Chen