Re: [PATCH hci-8.1 0/3] hw/usb/hcd-xhci: fix guest-triggerable use-after-free (CVE-2026-17588, CVE-2026-111819) #VSTOR-151666

[Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>]

Ack
Applied onto hci-dev

On 10/26/26 1:46 PM, Denis V. Lunev wrote:
> A guest can crash QEMU through the emulated xHCI controller by pointing
> the event ring, or an MSI-X vector, at the controller's own doorbell
> register. An event posted outside MMIO context, such as a USB transfer
> completion from the main loop, is then written by DMA into doorbell 0
> and runs the command ring re-entrantly. A Disable Slot command planted
> there frees the transfer and endpoint the caller still holds.
> 
> VSTOR-151666 is this crash on a production node: qemu-kvm SIGSEGV in
> xhci_ep_free_xfer() <- xhci_complete() <- usb_msd_command_complete().
> In the core, intr[0].er_start equals BAR0 + 0x2000, which is doorbell 0,
> and most crashes of that VM follow the
> "Blocked re-entrant IO on MemoryRegion: doorbell at addr: 0x0" warning
> by a second or two.
> 
> Upstream fixed it with these three commits from Thomas Huth:
> 
>   f91b0544fe  engage the re-entrancy guard in the xHCI timer callbacks
>               (CVE-2026-17588)
>   89e653b773  restrict xHCI DMA writes to RAM, so events cannot reach
>               MMIO at all
>   cfa70f3a82  engage the guard in xhci_complete() and the other port
>               callbacks (CVE-2026-111819); this is the path that crashed
> 
> All three cherry-pick cleanly onto hci-dev with no changes. The only
> local edit is the #VSTOR-151666 tag in the subjects.
> 
> Upstream has no test for either CVE. hw/usb/hcd-xhci.c builds, and the
> existing usb-hcd-xhci-test qtest passes. The attack itself has not been
> reproduced.
> 
> The same series is needed on hci-8.0, hci-7.4 and hci-7.3 and will be
> sent separately.
> 
> Signed-off-by: Denis V. Lunev <den@openvz.org>
> 
> Thomas Huth (3):
>   hw/usb/hcd-xhci: Set reentrancy guard in timer functions
>     (CVE-2026-17588) #VSTOR-151666
>   hw/usb/hcd-xhci: Limit DMA transfers to plain memory #VSTOR-151666
>   hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code
>     #VSTOR-151666
> 
>  hw/usb/hcd-xhci.c | 52 ++++++++++++++++++++++++++++++++++++++++++-----
>  1 file changed, 47 insertions(+), 5 deletions(-)
> 
> 
> base-commit: f3c1d9ef263edfab8d2a273078493bb766dcf8f8