Re: [PATCH hci-8.1 1/3] hw/usb/hcd-xhci: Set reentrancy guard in timer functions (CVE-2026-17588) #VSTOR-151666

[no-reply@sashiko.virtuozzo.com]

> From: Thomas Huth <thuth@redhat.com>
> 
> The xHCI controller processes USB events from timer callbacks
> (xhci_mfwrap_timer and xhci_ep_kick_timer) outside of any MMIO handler
> context. The device's mem_reentrancy_guard is therefore not engaged
> during this processing.
> 
> A malicious guest can exploit this by pointing the event ring base
> address (er_start) at the xHCI doorbell MMIO region. When
> xhci_write_event() performs a DMA write to deliver a transfer
> completion event, the write lands on doorbell register 0. If the
> written value is 0, this triggers xhci_process_commands() reentrantly.
> A CR_DISABLE_SLOT command prepared on the command ring then frees
> endpoint and transfer objects via xhci_disable_ep() / g_free() while
> the outer call stack still holds references to them, causing a
> [ ... ]
>     Jiashuo Liang <761232680@qq.com>, Guancheng Li <lgcpku@gmail.com>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4195
> Reported By: Ken Hsu and Royce Lu of Palo Alto Networks
> Message-ID: <20260915112213.525283-1-thuth@redhat.com>
> Signed-off-by: Thomas Huth <thuth@redhat.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261026114645.187003-1-den@openvz.org?part=1