From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023115.outbound.protection.outlook.com [40.107.159.115]) by lore.virtuozzo.com (Postfix) with ESMTPS id A9C0C80D23 for ; Mon, 26 Oct 2026 16:13:42 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=a7UbPxPfafrDU3pAH6/LXDu5oEGWpz9sis51qiXM8npwRvrQ8R8Z2MiUehoDTIK1aZfjxybs4l1FrtC2g0HgfrTLaPyX6tF6LCOYtUjBo29vnUfqNElZ3orJNEgEZC3aVajaXeP00A7C+TVzsKBJTZ2vHpx7wSxeokG20/N/EwsMwC1D/hQwt/SuKiq9Mvmg17tHZxbRz//UCpV90B4EGfhzDW+qUecPYCOqs+j4PllYunPRt6sX/wr7xajesB+f2RePNnmpqrZLcqcFMuGrd4CGTSt1ML2Slr2vvbPBkP6/es0aGrGNnnfa/K8EbmDPyHbwOxDuuCQHoLNWq43Cuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=hkvPgYHpc2BZrtjnwbjVBd0lqqje5YdwNKdU+7yfiwk=; b=gGS/CHRLPlrKeXlVVEpAzF6iU2plNelGEXtdJvmHDOuU5K/ZLVmjOKceYkgZwG0BD2MRrOScXfu9eqRZSuw1RJ7/ldBrX2/wM9mAgdlBuw9ok6lQ6tqLf0bMpAGcI+iZ3FZGAKkphwXJh8AW0tHwrETYf+N7RoHC56CMfcUx9DBaw6lFBsroTI2h5mG6ikBt2NhVeLiCwxi92HBOl9T5eHIa4L98USeLo6/27KH6Gwtq5lRUMA5icMr6+mytv/TRd3eA0JWuuyUnHyg4yiDgjU/oTBxrjNzDcW65No7WY2k66+ltiHdUsXITeUmqOGc2uMoOWXaJ06I0wQyb+B0gmw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=hkvPgYHpc2BZrtjnwbjVBd0lqqje5YdwNKdU+7yfiwk=; b=Scj8+iRBu7dQ5LkgWJD2vSzrvZqmdQDfawrwjmPMhIohdt8FBMx2xskhPAr4hQoFUSQYBY/tq7fkY+fRuQBjHuNMa34EhA2FNGnGP4UQG71Hk+M/aRhfU65aLQTVBK2vieRcL91594s0KTxVoalKdigZEcxp+sKQhOdHHFlR1uRFm3z6pGQwNQ6u4AtUPvsqoScoolX7zGTS0nHDr+oZ+QW3QLZlZe2D5FZfGUIkiZkyoSbmx3xK5ble7dBK1fPA8EBjxMSLYsetR58Us7bETf5ZAsFDY24Kr2aalbtuYNxZRwgUBWfk4T6PFQAHF3DhnBzmBLovz2Ez4tbvNcfOVA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DU0PR08MB9463.eurprd08.prod.outlook.com (2603:10a6:10:42d::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 16:13:39 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.021; Mon, 26 Oct 2026 16:13:39 +0000 Message-ID: <21983bd9-fb9d-4de1-889a-48f9f5fe8019@virtuozzo.com> Date: Mon, 26 Oct 2026 18:13:38 +0200 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH hci-8.1 0/3] hw/usb/hcd-xhci: fix guest-triggerable use-after-free (CVE-2026-17588, CVE-2026-111819) #VSTOR-151666 To: "Denis V. Lunev" Cc: svt-core@virtuozzo.com References: <20261026114645.187003-1-den@openvz.org> Content-Language: en-US From: Andrey Drobyshev In-Reply-To: <20261026114645.187003-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ClientProxiedBy: ZR2P278CA0047.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:53::12) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DU0PR08MB9463:EE_ X-MS-Office365-Filtering-Correlation-Id: 001c8325-bcd7-4029-9d11-08df337c1815 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|22082099003|18002099003|6133799003|5113699003|261026140227099003|56012099006|261022075727099003|10067099003|261021123027099003|261021121427099003|261022105027099003|261009223027099003|261026121527099003; X-Microsoft-Antispam-Message-Info: Wfzg+rGhYNvKy1NuQCWjLGinBayFNbrthu7Ykw5pKVsQU+KY965BRZglsDO2QpzzkaqvQOeS3DTC4OMF7+vTeUdQmmoOOdCR2KuSC10rmOCbYLRD84cml5IrHzq59VjJLaaUjCMDG9dAAO27339nR7qHlAjGb3GknzXQdCgBttZLqibaAFTwx6KPeW3ixm1tDoUbKQMi4G6LeysNrX7FdU0fOmPR+q10PZ7F6Um4QCJlxRA4x6DlxHw599c5y1XNCAQfnYZ9cwB0GqKxWDT4/Bhv3Qn5g+tPa67BbtAGfosvoLhUx2O6HjtI/e3ywCi09uAzJNZyQGuWuMTQJxvH7hUQU0jFe9H/MqrVQFPA2D5ecgOJZGQ5wtLw6dvsUnccAQivHsxQNc4mrsdoKhm7stSvIHS9IbspxAGauOfN+/PrywkqwgeR3+IA7iJ/JcuXrJfx7Uvl3x6siPYao+RVbCam8NJ/74v5i/0d6BWMtKkT3qTpAVvOTKCqOyHfeQ4z+lCy8iCv1VjLInJXJenOzSPtz4Xl8FC6zAH6fnkCUa6vd+uGJQFEo3159CZGTNMFvYQDV7mzwqWSF8D1DJ0okImZlrefEAKgFM9/RSPSkbAVsjp4haQID3aUKl40FCk4ULjwx24D71bGVsQB7HqNkZnrsVeBbbIz4VZ2v34y+EI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(22082099003)(18002099003)(6133799003)(5113699003)(261026140227099003)(56012099006)(261022075727099003)(10067099003)(261021123027099003)(261021121427099003)(261022105027099003)(261009223027099003)(261026121527099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?YS9ESXZkTWo3bXpqSVBVMnNUSjBXcEh5TUxBUjF0dVg3RytHdTlFR3c5Zk9B?= =?utf-8?B?ck9IMHgrbGxKcTlhTEhtb0g4MGNCRURoSEJrZHJRZkJUTEtROVNWT3FoeTNS?= =?utf-8?B?T1lIZVF1UzJCWnd6MFp3UTdlUVROQnNWcTY2MTh0c0NKMEhrQjB0RmNGOHVZ?= =?utf-8?B?R3FxVkIxVWp0SDNEdklSMnFxRzJXM3BJdGRlUnVHUFVmczBWZFVEZzFnQ2cv?= =?utf-8?B?MzhQNGNwZGlHdHBQbTFJVWgvYWNZUm4rMTdvbEMxaDdOTW9QenNMeFh6ZlZM?= =?utf-8?B?QVFBZEhGekVRViswNkhwNG9kWUZyMzZVUlhuUTJFTkhKcHdUb25mL0djWWVF?= =?utf-8?B?MGtSUVB5dVZ0bkJ0OFh0MXlKclRxNkhoWTNHSVFSdjR3ZlovNkhuYXNybXRT?= =?utf-8?B?MDZNTGdvaU1KMUFWalRNaXhVSjhsUEhXSWZFbmx5b3drRHhEbVZOQUdCcDY4?= =?utf-8?B?VnJPbHpqMzQ0SUxKNUk0STN0emQxcE05Uzc2aUdlUlBWaUpWemtFcy9oSXFN?= =?utf-8?B?eFJQSlpoZlRRUnlIYWpkUjV4UElYYlpOVXVjcEZqSlplYVVraU9OdHpsdVVn?= =?utf-8?B?OVRKVURPaDJqUUZJUjM1NGh5cmljZ1EvMmtPT0JqWnp0SVFVRUdFN09OK2pO?= =?utf-8?B?eGQ3QkIxcHR0dlZqM0VXVkVldTE5dUZobzhPK2xTdFA3WkN0cnZsSXJ4U1RM?= =?utf-8?B?d2hiL2tiNXc2SHNhcDFBQ2VFV0pBUHR1YUtVbDBxeFFLZUtwOGdoYWlFN1Ez?= =?utf-8?B?cHVqdVJrMzhwamtqT3IzQTBBUUsxTGZWMndxdSt4d0xjOG1McGNpaGNoL1ZP?= =?utf-8?B?aXpsS2xTTjhtR1M3KzRjc1d0L21qVEZhSlBCUVc5Vnp0ZlVFaXRLLy9EZFhB?= =?utf-8?B?L0dZR1BLWnNlRHM4YUsvaG43cWZ3ekpaRFhkM1loNDJIa2ZVZ2dVR2xBa3Fa?= =?utf-8?B?R1JBTWJ3TFg0RlREd0VrM0JXc0oxSlhyOU85OU9lK3dvVG5nRW5iTk16NDc4?= =?utf-8?B?YWd0ZVFNVVM0VWpCdzNyYkJ4bVk5ZitYTXdRZHZTMGdFc0xoUVYreVp5YWJq?= =?utf-8?B?VE05NWxFMzBOK2Eza1Y0YjN4ZDRTMUZjeXZyTHdjNVVldU5rODBxVFY1dHBZ?= =?utf-8?B?TjFGek9YS2RDTkdKbHpwRzF2L1liSndBWnJvSVBDbmZPVG5XeDJKdzUzOWNh?= =?utf-8?B?T0MyNTcwWGptd01hNVcxM0JmME1YUy9qRm1TRzRjZlVXUHQvVVp4d0VoODdI?= =?utf-8?B?SmxROGwwQTFqd1NmNzZXNVBBNmtZTUFNUHpKZHhGSEpRcVJDMHpzZXJqNlVD?= =?utf-8?B?bGdGTWNpNkxSSTNtMnRyNWRMQjlrZTcxbllKS0g3TGJjTUlTVkNna1Z5UVNW?= =?utf-8?B?V2dzNWVFSTN5Nkg1cjgyQU9KdG45NU1zaXV1NVd6WElEbkJ2TEFieU5weHdY?= =?utf-8?B?RkUrLzN6aTIyc21pRGZwWUNjdFBGWGtSSUd5UlNZZzdtSUxlR1oyUlV3UVBT?= =?utf-8?B?bnQ2TW02cFE0aVV1TkIrUlIxK295b3A4WkR0akFhdml5RVY1UURYU3R0UXM4?= =?utf-8?B?TmZ0c3FKN213VnhsSHVISEtxYURWRlVVM3VOcVJkVTZOam5WK2FXM2NsS3hQ?= =?utf-8?B?NE5zcDJ0V3ZvS09hMFBlN2xrZVczVVg1emljbGNTNTR3bEcrd1E3NkpCN2pz?= =?utf-8?B?a0xvQm54aUFZamdhZWRnOHp0SVRNQUJRbFdEclRGaDJBRzFsVlVSeU1HOUJP?= =?utf-8?B?dnJhWkV0RGFMVGxwdnhlaXcrSzQyeFVxR1drWFhkV2xBLzMvUHhOL3RGckpF?= =?utf-8?B?YW5ZaGFmS1FLVyszeERzaUJ1aXRuNTl0bnU1TU9EUEJuNGxuQWNZYWp0UDU2?= =?utf-8?B?TDN5enBhTHJqc0FDcVlvdVYreXA0NHE3YmxYdEZ3NWRSSFdmZS8wRjZiUmZY?= =?utf-8?B?SkVPR2wxdGNueGcwMTl6ZkIveTVTUkN3NnFHTVNBUkY2NjZFKzBJdVBNVjlu?= =?utf-8?B?TGttR0pYdHNSUDR3UGc2ZlBudHZtbXlVVFk1SFAvb1RNbTM4WnlGekVLeVNw?= =?utf-8?B?YmVYTGhHQ3dHVXFHUEtnUDBuTnN3Q2JHVGJrcE9IemdBNC92L1NQaFlFSlV1?= =?utf-8?B?S1E4V2NIWDQrcm1sR09MUjMvNTJsaldpbHhkWTBvWmEyM0hHWHA0VUlmanVr?= =?utf-8?B?Njh6OEJ0dDQwSFlVVXlwOTVqdXM5NW4rdEdSMWdhbWdLa3Z0MWRIOG9wNEVh?= =?utf-8?B?V3dvNHRsWHVWek1MSmF0YjRwRm9NY2QwSGVOZm1BYjhjN3JCVkxRNmVkMjVn?= =?utf-8?B?S2czZDVlVE9JaWxrWEFsZzdsZTFGekFwYmdwYXlHR05wc1hJZ09Id2ljbFpV?= =?utf-8?Q?+BfNUBivZHqY+5So=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 001c8325-bcd7-4029-9d11-08df337c1815 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 16:13:38.3802 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: BsTXJ0eiGIHNUt/i8ZwSJ96bm4j33oF9A7qZjHJpYXhhqOhaA5Oli8dKUSXeNXfYfuGqx9GAsaeQTz3aDyQLzEAz2VLGt3sIrS1DGo2kU6Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR08MB9463 Ack Applied onto hci-dev On 10/26/26 1:46 PM, Denis V. Lunev wrote: > A guest can crash QEMU through the emulated xHCI controller by pointing > the event ring, or an MSI-X vector, at the controller's own doorbell > register. An event posted outside MMIO context, such as a USB transfer > completion from the main loop, is then written by DMA into doorbell 0 > and runs the command ring re-entrantly. A Disable Slot command planted > there frees the transfer and endpoint the caller still holds. > > VSTOR-151666 is this crash on a production node: qemu-kvm SIGSEGV in > xhci_ep_free_xfer() <- xhci_complete() <- usb_msd_command_complete(). > In the core, intr[0].er_start equals BAR0 + 0x2000, which is doorbell 0, > and most crashes of that VM follow the > "Blocked re-entrant IO on MemoryRegion: doorbell at addr: 0x0" warning > by a second or two. > > Upstream fixed it with these three commits from Thomas Huth: > > f91b0544fe engage the re-entrancy guard in the xHCI timer callbacks > (CVE-2026-17588) > 89e653b773 restrict xHCI DMA writes to RAM, so events cannot reach > MMIO at all > cfa70f3a82 engage the guard in xhci_complete() and the other port > callbacks (CVE-2026-111819); this is the path that crashed > > All three cherry-pick cleanly onto hci-dev with no changes. The only > local edit is the #VSTOR-151666 tag in the subjects. > > Upstream has no test for either CVE. hw/usb/hcd-xhci.c builds, and the > existing usb-hcd-xhci-test qtest passes. The attack itself has not been > reproduced. > > The same series is needed on hci-8.0, hci-7.4 and hci-7.3 and will be > sent separately. > > Signed-off-by: Denis V. Lunev > > Thomas Huth (3): > hw/usb/hcd-xhci: Set reentrancy guard in timer functions > (CVE-2026-17588) #VSTOR-151666 > hw/usb/hcd-xhci: Limit DMA transfers to plain memory #VSTOR-151666 > hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code > #VSTOR-151666 > > hw/usb/hcd-xhci.c | 52 ++++++++++++++++++++++++++++++++++++++++++----- > 1 file changed, 47 insertions(+), 5 deletions(-) > > > base-commit: f3c1d9ef263edfab8d2a273078493bb766dcf8f8