From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020130.outbound.protection.outlook.com [52.101.69.130]) by lore.virtuozzo.com (Postfix) with ESMTPS id 95E3F80474 for ; Mon, 26 Oct 2026 11:53:35 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mTNAZixI0epFu7B4ym52+sM8K6fhcfqUR4FVJGv/2Xm6KCZa7jU8N7k9tIwEme7RhAtKrSxJvu+sm83OblpgqpxK0TOAbHj0ydAzaZEWiGlTGOSIwUePPehYnm4Skb+4YsUE4IyjosNGMphrLdK3Ose88aYZPvRy7ElBNNswN2js7ih2T/pS9I37gxIYG/OSYGL1dSpSHBaF+eA7b8axd6lzAt9js+r8PonZUQDjfiY+5RQBBYM+TIdJKFuqdGv4MKNfp0bxYIJ7pufS8UrLSSfdmgzy1pSIkkQXdIvZuwXmZv/eGLZBsHngqA2U+mCL6eAWJtj0EpNzPzpnwa/cGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6zhQWK0hiQox02nVLyJYt6rJXytzoRg1A6beb1ggGaI=; b=gzSrZ2fP74XkxpuWFtoW7TJhY66+mNi9ruSbz1aMVVeTqsj54OZoIywkl52ehhuH+hJGTdiI35/NBopwGeXZfMYXo66xvRozowG16tvmcCTzMOnjifvF0Dc0pAsxLzvCS2t+xFFHW73in7sBBB77+SVm2+V1ATfwUiEsPSUhIOFOL5p48LNuccIKub/owoWqEOiz775OmrkwrPzQvps7/SUnSaJz2X/0Vwr+q/MiqpBVtMAkNsMhFrZIc+V/iK9ct4QFgakn+PSO91+8q5oHTtFRGvbbx+NYc1JERSKuSWhNl2jhDwl5FDEzLazrEWzTnW95nEDZ4SLV5Spwd8v3FA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.5) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6zhQWK0hiQox02nVLyJYt6rJXytzoRg1A6beb1ggGaI=; b=D5DMHrjn/BDo4tm8QgcM++hQ4KuFQJqeaMOPe7uz7EfMOAbKr25ey8ndcO9Y0v5xam4vtY0rsZXkSWviR/m8GhNB2KdClt6AY8NgbII2z7WK+lUW930Fy3pIi8fJFWU5e0C+zZD7hZdIWbgJyueZOFvLA6F2Dq1rNVNmG1Asgtc= Received: from AS9PR06CA0142.eurprd06.prod.outlook.com (2603:10a6:20b:467::35) by GV1PR08MB8260.eurprd08.prod.outlook.com (2603:10a6:150:a1::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 11:53:30 +0000 Received: from AM2PEPF00070CF4.eurprd02.prod.outlook.com (2603:10a6:20b:467:cafe::2b) by AS9PR06CA0142.outlook.office365.com (2603:10a6:20b:467::35) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 11:53:30 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.5) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.5 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.5; helo=b224-5.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-5.smtp-out.eu-central-1.amazonses.com (69.169.224.5) by AM2PEPF00070CF4.mail.protection.outlook.com (10.167.242.6) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 11:53:30 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1793015610; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=6zhQWK0hiQox02nVLyJYt6rJXytzoRg1A6beb1ggGaI=; b=zNyWPHhH3263X+j3aQkI5d4eKjkw4jcBulrG1HIfs5kPQO8ejBv7Drbs6SuNNu0r QbgbwntsFMtu27UUw175H8uGb7OTzoj7TUKhxhyvRoVBYlMx/Dxg3rgvpvPtK0PcxzY sy2MrNWfZHd0GlgzeeTA1Wpf+KMOyqWJse63GR2UJXFj6+BHoLByQaKSONTVnsLuk21 A+O2i1hYLmfNgRlC1phuQ0mC2dDuWYc24/OQZlgD8xjIEhOsT1UbQa+0J9OFWsM7Npp XZ3HsoHleDIacr14qmDkl3pZgI/hv9APeeWCRdAGt90v+jDWjP76Mal7BpszYw8GHg7 DG0K5offrw== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1793015610; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=6zhQWK0hiQox02nVLyJYt6rJXytzoRg1A6beb1ggGaI=; b=lRDNB2CuaCBGcb2QhbCkNjqxnG5e6vie9p2u7XRYRK5iQEjIFunuVGwiHLl+Mqwp LJZuqkE6fjyMoJ+U6rc3GukGI8fFGPQZLypp/GrbrZXwe8lRFqjERSiEAgodoV6iqWG eiVH/0UayV53zDHUOAGZCV67adwkV9i+mF/Qz3WA= Message-ID: <010701a1780ef9e3-67730ea4-6c14-4461-ac86-d6630049357f-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH hci-8.1 3/3] hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code #VSTOR-151666 To: andrey.drobyshev@virtuozzo.com, "Denis V. Lunev" Cc: svt-core@virtuozzo.com, den@openvz.org In-Reply-To: <20261026114645.187003-4-den@openvz.org> References: <20261026114645.187003-1-den@openvz.org> <20261026114645.187003-4-den@openvz.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 26 Oct 2026 11:53:29 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.26-69.169.224.5 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AM2PEPF00070CF4:EE_|GV1PR08MB8260:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: cd379ea0-9cba-4154-5b85-08df3357c104 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704162011799003|9140799003|32142699015|48200799018|61400799027|376014|18002099003|22082099003|6133799003|4113699003|5113699003|55112099003|16102099003|3023799007|56012099006|5063699009|5023799004|4143699003|261021121427099003|10067099003|261009223027099003|261022075727099003|261022105027099003; X-Microsoft-Antispam-Message-Info: yu49tYXMEHaWZyPgFiNZRMqvh2EQrE2uudArwf8ycSBxYDHA4f8C4TGLe8T95X32kNaytuwMcUHYubrG+E8CS/x8V5L36AwEQK01/DwJj3sXJ4aELNF5M1nC63WeGSKbthu6d2LX8N3+ZhN8g1Cf/WT6Vmm5Ls0FI3eQ+ozB7EopdTEi5Ld5vAZb/04gbmxTXkfH7ByYJanbr4Jci8gwTyIb2QXgOtcvAOE47md1IsmPPD/n2RQS4RpFWNT8AkgwBQZAHJA+j1s7n9BDdc2tzPziUgnFTiLX/4I11Llmtte2LZ2HR0JJDGTE8iWOwchRGPdBV4Z5jTXhwEbZRaSUKaZQPM5JWrbo2Ib+3C3ZBU2U++1Q40JjpyXqXkEXS562+dON/yzJJrnmeYHf/SIn9VgJyPgKUN8803MX1GQhPgFeca7tF/vcwSqidbKOpxrYmBw3fR85ji3bPSSWJQIv82q+IgMeWun2kBxkzp8JVByekb5J0WHaCBkNAw0dbZP+P9gvnA8KGz5ziHtzg8jfFJI0n6M9L2W/WcemNTJRSryKkrRUvNjZhHoSbSFKx/b2EDaU3Nft4fGPtUUIEBIqe7YYuCQ6YfDY5XJI9cAeKlYhdJEnzuoeLEF7Av4Y4QECxdCcg8sfgcNFZXrq1OySgIlKtMi+jkA69meSeNOQMSl1DGZ5bBhaR3M04CGuZZx2mukyW0xs8mr1mwA0JjLyfATOSaElTUvheh/p/gwxRh4isZujjGa2r6kg+h1AJpa26w0wpr4fDZIq6rAvJYNi7InuwhS14Yarw/EL+lzo3bHKILlH8wOl9gIMuWGlplmr2Mqn0ibqWkxUkM/7eTGNbB3glkx7pJANRKfNlQA374b+JaSG25ScwpDz2APwhegM X-Forefront-Antispam-Report: CIP:69.169.224.5;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-5.smtp-out.eu-central-1.amazonses.com;PTR:b224-5.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(704162011799003)(9140799003)(32142699015)(48200799018)(61400799027)(376014)(18002099003)(22082099003)(6133799003)(4113699003)(5113699003)(55112099003)(16102099003)(3023799007)(56012099006)(5063699009)(5023799004)(4143699003)(261021121427099003)(10067099003)(261009223027099003)(261022075727099003)(261022105027099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: a0IX5UOBzoMY8MvALC/ZSsSee0QClEjZFdYId0CTAyIYfaq2fm8hDiK7GWJYlxv+vsa8lQXWhwbe9BY7rW58Ilc+IZfla5ZDvopq25IJtvIlXIUb6pvzQySSsZYEWbijG8UCn+WgG5VCFGVd7zYjlglXTxsuAGOWi8HcK5Eqj3G798XgXZCBMlrgDTMClkPWibi5Icqhhcw3A8uEkgpyqYeQgWNEMfCmIIeG/Ke5AoC/OZuSgCxU0kTxoSUrVyjYvcOv0Zx01pH3wfmVljsYf2uJE4UI6RE4FR+3QnLUqWZdSpz0XbWbODnIQzDq97tU8qPAA9Ksmz6w/+r0wtW24U6xKh5hKA6raQqzBP0iJbHoAcXmIausPL3I31XdCNVqw5hnQB/kqztzQcM/PAqbz/+vJjUeeIeLc/0Ifrj4OmLbCiRGMPntqzsevRirrLZ6 X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 11:53:30.2711 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: cd379ea0-9cba-4154-5b85-08df3357c104 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: AM2PEPF00070CF4.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1PR08MB8260 > From: Thomas Huth >=20 > The XHCI controller's USB port and bus callbacks -- xhci_complete(), > xhci_wakeup_endpoint(), xhci_attach(), xhci_detach(), and > xhci_wakeup() -- can be invoked from outside any MMIO handler context. > The device's mem_reentrancy_guard is therefore not engaged during > this processing. >=20 > A malicious guest can exploit this gap via MSI-X self-targeting: it > programs the MSI-X vector's message address to point at the XHCI > doorbell register array (both reside in the same BAR0 MemoryRegion). > When any of these callbacks posts an event via xhci_event() -> > xhci_intr_raise(), the resulting msix_notify() -> pci_msi_trigger() > issues an address_space_stl_le() that writes doorbell 0, triggering > xhci_process_commands() reentrantly. A CR_DISABLE_SLOT command > [ ... ] > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4625 > Reported-by: Ken Hsu, Royce Lu, and Bo Qu of Palo Alto Networks > Buglink: https://gitlab.com/qemu-project/qemu/-/work_items/4642 > Reported-by: Nikhil Agrawal > Signed-off-by: Thomas Huth Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/2026102611464= 5.187003-1-den@openvz.org?part=3D3