From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021112.outbound.protection.outlook.com [52.101.65.112]) by lore.virtuozzo.com (Postfix) with ESMTPS id 1D7178017D for ; Mon, 26 Oct 2026 11:51:21 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=m0ILBWxAnPpG2xHMsbXgir6VNSBpQyfmLrtrECoyq15Auyjyb3fwSlgUB7yBqkFxI5QqOTej6PmhX3Jn51G+Ke1m1c1n4+oDF//vmAYJsaOqbIOsa4sl7bvrw2xj5aLiR5w40SI24sZ5R4XYnIXuwpIhnK60w4s3NLwGwCPy0dU1QiPqxKCx01/25aXgrBxKKGo1SeCeejNRbZZ/pl8L2bobDhjdXsB+OOUQYxty1fCMjHa0RTk6yWx9IQnmanOz+UYDdiJf+dOQYy7R0FY3z5JW6L1Vn+ESOSbZrUcoHx897uAojm95D2pj2l5YzhPYhzQ3uuEcjwkvt51oVdDvWg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GprTOS99sw8YRx06rFlAH/wpXZQx+dHij81HsmaE+bA=; b=y38VfhCryQhjhbBLuS1dJCihkgVLP9xkp0HVzO1NmbVm4cYWBuSZWSHeZmkhGMkjcC1mC1yw4hFK60c1f1Zrp1t6wNFkmS1I4ySrjItjPB4twyZ6Irc2OUF9cw9f4Rl+WTtUbi0xz1NXXdlRs6rwVyg9NR12pLTU5lICig1tTkjCT4ChCvxjU6MTbD7qQasSfTKXfkmhD2KVjji5vdLLDdsnVJ/YY6R+7RTlUHLzAG5CpVpLVPScclJgYpj3OES09uMqs/ijWQ2hQc9dS4gNn2Oz6Jw8dgiQP3CslKgF0y1nKPnCakMo9dvixox2PQU5Maw0bPTHtXMS4DFI4oj7VQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.1) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GprTOS99sw8YRx06rFlAH/wpXZQx+dHij81HsmaE+bA=; b=J9hryGFK+Oee5VFp3m3iVHncbvbA3pWB4ufvu+DfJs+gzGwaSMdWYeLVTBJ1srulHkq2wkA3hz0Qus5hMXGhDBr/gApnLLKOlIrzENbodHifQW4hZD2ihhU4pnaftmluqPDRfhdd7DgkNesSsIRkJb13SDkRFZyv9OfoyZNG8xE= Received: from PA7P264CA0063.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:2de::18) by GV4PR08MB11276.eurprd08.prod.outlook.com (2603:10a6:150:2ef::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 11:51:15 +0000 Received: from MI3PEPF00008555.eurprd05.prod.outlook.com (2603:10a6:102:2de:cafe::6b) by PA7P264CA0063.outlook.office365.com (2603:10a6:102:2de::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 11:51:14 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.1) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.1 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.1; helo=b224-1.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-1.smtp-out.eu-central-1.amazonses.com (69.169.224.1) by MI3PEPF00008555.mail.protection.outlook.com (10.167.240.9) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 11:51:14 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1793015474; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=vhBklTC/+fM5Cg6BkEwKoEkezQzTbD26mub1BT9Jlc8=; b=ZzqoXG7og7DLYr7hQ5TboRyM6zooDJaZCh4iKrh/pcvG+P0DF52JVA0I2EliQqZM 8Sxl1PTi+QtkJ3TUM9rh2Fsv722RSiBGzrQd3L+4AfhH9114nl1QRSaJ9adzdzyGhxQ 48NaNxB9h436Di6Cm3IrD+5Y+aXKlelvZjpRoRdbfU+pugYUNtdOn71PXu/QpOn4pj4 jUy2rPDq9lFTD15wwrBBQnjQGmXWTPdn6WMWxbCPOIHTXgjBcVMk84CJhhZtLuV7H6b LeHKx00ifPxvZLyExdCiQiVK5MhxrcRX6b6kwIEIMRn5fSd/YV/mCxY7IyRtp1h260Y YzaBOOy//A== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1793015474; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=vhBklTC/+fM5Cg6BkEwKoEkezQzTbD26mub1BT9Jlc8=; b=epU1MuwXsl3QSdv1nacsa6JpoM2LUez+YFMUOqxS4o9SC3SwE6udy88u1GjzXxKH mabW92jGl7lMKjwN17R/1HjaB9We8wZvEjILyQfKvE/P404J9UkBpt2+REaNkVCc2/X hb3lubjw8OoCNCCpcPmhCTaHldan0quM8ukxXDfs= Message-ID: <010701a1780ce79a-a66a6e1d-0897-471f-a797-4aeed1828bce-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH hci-8.1 1/3] hw/usb/hcd-xhci: Set reentrancy guard in timer functions (CVE-2026-17588) #VSTOR-151666 To: "Denis V. Lunev" , andrey.drobyshev@virtuozzo.com Cc: den@openvz.org, svt-core@virtuozzo.com In-Reply-To: <20261026114645.187003-2-den@openvz.org> References: <20261026114645.187003-1-den@openvz.org> <20261026114645.187003-2-den@openvz.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 26 Oct 2026 11:51:14 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.26-69.169.224.1 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MI3PEPF00008555:EE_|GV4PR08MB11276:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 3f8d14d4-446a-4828-e159-08df33577030 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704162011799003|9140799003|32142699015|48200799018|61400799027|376014|22082099003|18002099003|16102099003|6133799003|4113699003|5113699003|55112099003|10067099003|13003099007|3023799007|56012099006|5063699009|4143699003|261021123027099003|261021121427099003|261009223027099003|261022075727099003|261022105027099003; X-Microsoft-Antispam-Message-Info: 0XYs8QPMwrRt6C9AyB4s7YsAoNpGXWWOx/KsSTFD+O+xwJ0Gub7Z8rxXZYh7OMlhcE/YbljkOPeFnsPnNx8tWGNeo6qZ1D+5LLqUlwpuBdodLgZOBN6kK4TnCsWQwjQ6YzFBp33T2UhoAi3UfFGQTnh8KOybvThllp1mJ9Iook3j0snx7yfMK59Yx0EVfeZPSsPxJPlCGY4clLKFjRuB+Y/i3H+9NBXQ0jvmv9IfC7sPm9rj7JTjhQxzo75IZ6NzTtqrhgvSIatqjtocOdSTaa/+2Ostfjr1Egt2tRnBL4mrlCZmevDGm4Iud6humnGp30rl9+6j/uqGifnfL5+ub0Erkb1y2emws/wzvUB9fqcw+h1Y/DDvotqa3jpbqFGztZmr/IXew3iLgtSIjyZ4s3TXb3+LLSW25uduccUpjim2/naLViqqTU661cpgXraE3QRB259fRRQAwqLCx/FY6XHowECmJiH/SbokpIs5Xr9zt9p+8L+7kwjh7D3NR2BjCp9oqaHZ3lhC4uu4WXlVjRAdo8tNbwDoHs9u0tbHN/qB4UnEywnt1Z5mEwtZhS8EqAsMRvvYuvRlKyqDAVEnApG8IY9+p0IFfgMgmk07D3EXi1f7sPdysQDMtJp5/7OSfO9vJ5Gq3w3S6ieApWJaoXx5DyLpFQszrOXza4ppS3ga7tw8ZaOjTDbge603xS0MVwdFVKOqCRo7FipmSHyXMTd8SwTqZ19PtXZgCse9M6VzQIf/Pf1Ob0zVRwmso3Lpy/sNnANIbl8X0uevbwb4jrn1EKyi4W+x3Lz7Lmzti6T/ceehB9Hmbn/zbXww2Z9F2cv4w32ET6mcfNepZ9Ybdy8DQGGAGkA30dOfBmV1SqUM9nU2STjIxhmoctdhto/0 X-Forefront-Antispam-Report: CIP:69.169.224.1;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-1.smtp-out.eu-central-1.amazonses.com;PTR:b224-1.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(704162011799003)(9140799003)(32142699015)(48200799018)(61400799027)(376014)(22082099003)(18002099003)(16102099003)(6133799003)(4113699003)(5113699003)(55112099003)(10067099003)(13003099007)(3023799007)(56012099006)(5063699009)(4143699003)(261021123027099003)(261021121427099003)(261009223027099003)(261022075727099003)(261022105027099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: a+cNXWTn0XzlDixMj1l0JoIRwhTOHCR51MFWAnqUFt0+gj8nbhtIWSSy0vyX/chCXsayzI3qQBXHhBC9WPyj9ycC82NB5p4g7ooNdYWRoDGfLLpTEFWPi+y5anTLF5eU7X8eXqCOAXAf89leT5Wj/ifJu3McWRb78FWP6pzdhm6//V/vPF84A6OXik+RQ/ytTcmKCm0i5NQLbt9N6mCCldAEprXaoRR4cARkXTF8IcQmjVcZS0z+Rr8KfulYvG64n0wm4P87dkQBdaRK58wYQ/yBH+I6uf3RVQG1eRs2AJE6PZLtQmp9I0ueKlHrXgx8hBCoMy44Txc9JxNkuHBJqo1Q3vfSL6KhZEbDNGfi7WeoWBebO1555ALzZ2s1T+VXuLTJ6QhXPi4I/al5R1QGNqYuSMIX5sTgMaun9zcGJN7TmmmTZqMwZsIUJm/9cYMb X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 11:51:14.6491 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 3f8d14d4-446a-4828-e159-08df33577030 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: MI3PEPF00008555.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV4PR08MB11276 > From: Thomas Huth >=20 > The xHCI controller processes USB events from timer callbacks > (xhci_mfwrap_timer and xhci_ep_kick_timer) outside of any MMIO handler > context. The device's mem_reentrancy_guard is therefore not engaged > during this processing. >=20 > A malicious guest can exploit this by pointing the event ring base > address (er_start) at the xHCI doorbell MMIO region. When > xhci_write_event() performs a DMA write to deliver a transfer > completion event, the write lands on doorbell register 0. If the > written value is 0, this triggers xhci_process_commands() reentrantly. > A CR_DISABLE_SLOT command prepared on the command ring then frees > endpoint and transfer objects via xhci_disable_ep() / g_free() while > the outer call stack still holds references to them, causing a > [ ... ] > Jiashuo Liang <761232680@qq.com>, Guancheng Li > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4195 > Reported By: Ken Hsu and Royce Lu of Palo Alto Networks > Message-ID: <20260915112213.525283-1-thuth@redhat.com> > Signed-off-by: Thomas Huth Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/2026102611464= 5.187003-1-den@openvz.org?part=3D1