Re: [PATCH hci-8.1 3/3] hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code #VSTOR-151666

[no-reply@sashiko.virtuozzo.com]

> From: Thomas Huth <thuth@redhat.com>
> 
> The XHCI controller's USB port and bus callbacks -- xhci_complete(),
> xhci_wakeup_endpoint(), xhci_attach(), xhci_detach(), and
> xhci_wakeup() -- can be invoked from outside any MMIO handler context.
> The device's mem_reentrancy_guard is therefore not engaged during
> this processing.
> 
> A malicious guest can exploit this gap via MSI-X self-targeting: it
> programs the MSI-X vector's message address to point at the XHCI
> doorbell register array (both reside in the same BAR0 MemoryRegion).
> When any of these callbacks posts an event via xhci_event() ->
> xhci_intr_raise(), the resulting msix_notify() -> pci_msi_trigger()
> issues an address_space_stl_le() that writes doorbell 0, triggering
> xhci_process_commands() reentrantly. A CR_DISABLE_SLOT command
> [ ... ]
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4625
> Reported-by: Ken Hsu, Royce Lu, and Bo Qu of Palo Alto Networks
> Buglink: https://gitlab.com/qemu-project/qemu/-/work_items/4642
> Reported-by: Nikhil Agrawal <nikhil.agrawal@mettlelabs.ai>
> Signed-off-by: Thomas Huth <thuth@redhat.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261026114645.187003-1-den@openvz.org?part=3