[PATCH hci-8.1 0/3] hw/usb/hcd-xhci: fix guest-triggerable use-after-free (CVE-2026-17588, CVE-2026-111819) #VSTOR-151666

["Denis V. Lunev" <den@openvz.org>]

A guest can crash QEMU through the emulated xHCI controller by pointing
the event ring, or an MSI-X vector, at the controller's own doorbell
register. An event posted outside MMIO context, such as a USB transfer
completion from the main loop, is then written by DMA into doorbell 0
and runs the command ring re-entrantly. A Disable Slot command planted
there frees the transfer and endpoint the caller still holds.

VSTOR-151666 is this crash on a production node: qemu-kvm SIGSEGV in
xhci_ep_free_xfer() <- xhci_complete() <- usb_msd_command_complete().
In the core, intr[0].er_start equals BAR0 + 0x2000, which is doorbell 0,
and most crashes of that VM follow the
"Blocked re-entrant IO on MemoryRegion: doorbell at addr: 0x0" warning
by a second or two.

Upstream fixed it with these three commits from Thomas Huth:

  f91b0544fe  engage the re-entrancy guard in the xHCI timer callbacks
              (CVE-2026-17588)
  89e653b773  restrict xHCI DMA writes to RAM, so events cannot reach
              MMIO at all
  cfa70f3a82  engage the guard in xhci_complete() and the other port
              callbacks (CVE-2026-111819); this is the path that crashed

All three cherry-pick cleanly onto hci-dev with no changes. The only
local edit is the #VSTOR-151666 tag in the subjects.

Upstream has no test for either CVE. hw/usb/hcd-xhci.c builds, and the
existing usb-hcd-xhci-test qtest passes. The attack itself has not been
reproduced.

The same series is needed on hci-8.0, hci-7.4 and hci-7.3 and will be
sent separately.

Signed-off-by: Denis V. Lunev <den@openvz.org>

Thomas Huth (3):
  hw/usb/hcd-xhci: Set reentrancy guard in timer functions
    (CVE-2026-17588) #VSTOR-151666
  hw/usb/hcd-xhci: Limit DMA transfers to plain memory #VSTOR-151666
  hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code
    #VSTOR-151666

 hw/usb/hcd-xhci.c | 52 ++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 47 insertions(+), 5 deletions(-)


base-commit: f3c1d9ef263edfab8d2a273078493bb766dcf8f8
-- 
2.53.0